Extracted

Extracted

• • Target

    8440422859df99edfb4a03e064876681e9e976557aefa0abb919cc104350eaac

  • Size

    660KB

  • MD5

    311a3ae52c66f539b75a1d5f2d011421

  • SHA1

    647d3f156604e0d2669a4ce98f5cd3d50aaa8aee

  • SHA256

    8440422859df99edfb4a03e064876681e9e976557aefa0abb919cc104350eaac

  • SHA512

    212b009098dfaef1e5cf04042d7373bd7eb7ec8f260e31bb32d84971d5395d470bb552dc076f853afc2d03a2716f4bdac9bde9996e838ccab43dbf75eb71a477

  • SSDEEP

    12288:EMray90WTOhcidLo3ZoYI6guLrZh/uFOlR8D1if2SbfY:my1aaDLD/uFdiDbA

  Score

  10^/10

  redlinerosnsporadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1