Extracted

Extracted

• • Target

    924cd72cdc07631eec4062c86efef331535adcda099816e87d9930905c76f243

  • Size

    530KB

  • MD5

    e6b9448ec13901b094fa580e680b79dc

  • SHA1

    01456c50d366bae7bb7a52d52344b388ff226bc0

  • SHA256

    924cd72cdc07631eec4062c86efef331535adcda099816e87d9930905c76f243

  • SHA512

    bb2e381de34c84d12eb318965f5dfe2290cae979f7a7dbfeee637f2158b3e521f0b9fbe1b4b448f82eaded32d4df34cbef11f4fa8f1d3d7ca3aea345d55bad23

  • SSDEEP

    12288:qMrsy90Y06t0B75G48VZW1NM+2f5KXa/cmttgM7L4n9T:Kyw9kI1NSAzmttX7L4n9T

  Score

  10^/10

  redlinerosnsporadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1