Extracted

Extracted

• • Target

    d77755cc0f9edd8c7e8181c51aa09e01d1500caaa1952fe8a1f24cad0329f365

  • Size

    530KB

  • MD5

    3a417edb2f359cc1e620d98acecf3955

  • SHA1

    ae353cb9ce2b6a752ce3f1edc0b8cc50dc953ae2

  • SHA256

    d77755cc0f9edd8c7e8181c51aa09e01d1500caaa1952fe8a1f24cad0329f365

  • SHA512

    066972084a0b5d1eb085be944f714260afcc2f26acee9e95cfb48c4ed3d8fdf79f11b209d0dcf720636b0dda6e99bfb6fdc65ef94565ff9557cc42ef1ed2a6da

  • SSDEEP

    12288:TMrQy90va6wlk0LLDqqjoJarrYSFY3f5KXa/aPJ3RWzUh4:3y6a623D3jMtzANPJ3RWzUh4

  Score

  10^/10

  redlinerosnsporadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1