Extracted

Extracted

• • Target

    76c4c52e660c2a3e0966cbc78f0e94392c227bb5d7dcb467864b32ab144164f1

  • Size

    529KB

  • MD5

    a488732e42e60c2134d3ab91d2f4a875

  • SHA1

    ed706fafc68aafe79d32bcadfd6170d531ccde1b

  • SHA256

    76c4c52e660c2a3e0966cbc78f0e94392c227bb5d7dcb467864b32ab144164f1

  • SHA512

    316c5910f5c24c483fd36fe93f22c58d9cda94715870e8f6a9b65d48401e9cd70f63dc4ae0f49f2a8265264c56dee1f6b0ebcddbd3b5f4d79db641f3f1650dac

  • SSDEEP

    12288:iMrQy90+smC7cCENhujvl7wjwhatXfABCLPMWu98:OyI7lWhu7l88h2vrBM8

  Score

  10^/10

  redlinerosnsporadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1