Extracted

Extracted

• • Target

    c5a8bbd10254716026ca616bde884ce9d1df39e23c86fed97edd790fa6a3f48e

  • Size

    529KB

  • MD5

    c0007c526d38afd27f2107c6d1141f0f

  • SHA1

    ef2d7deb1b497f4499b4a42549b4b9058e087983

  • SHA256

    c5a8bbd10254716026ca616bde884ce9d1df39e23c86fed97edd790fa6a3f48e

  • SHA512

    f9e492545683acff464b94ac26b57e975c95e80e852a3f57779d1cee5774bc43a839ec4e130d763adcf804a6f0dfd552c7b811a58408cb3600c3f77965ff83b4

  • SSDEEP

    12288:cMroy90OCYQD7bGFYBX7m5C6TNVKBTE8ZxOgoxKWt/BvBgw:MyHFQ7GyB686RV+TE8zOgwpj

  Score

  10^/10

  redlinerosnsporadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1