Extracted

Extracted

• • Target

    9c9a2e1acb59af5f947fd1595c130e950534cae05c0ac410d2eb4db6c0839050

  • Size

    530KB

  • MD5

    67000ccdd64b20e5dcb49772c6ad0836

  • SHA1

    c7d54b94caed1cd3aef1724a0bace590d716d638

  • SHA256

    9c9a2e1acb59af5f947fd1595c130e950534cae05c0ac410d2eb4db6c0839050

  • SHA512

    e1b2ee7d4f9da3e4b3217ee390540597860961bd95d5b5f06c6290a4bd2ffaa47cdc71b949b7c0df95dabe63e428c68a9c7316acc2af800ac6e93157334bbd7c

  • SSDEEP

    12288:lMrUy90jRUSLJTQir8ajl68LwPkLYnf5KXa/HUUZxGvOpRjzShk:tyyR/PjlpqkLcA0UFvw2hk

  Score

  10^/10

  redlinerosnsporadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1