Extracted

Extracted

• • Target

    6b6f04dba58447058f744da6d1d2718f993852a9b60b9f1c12b1501b5e93e3fe

  • Size

    659KB

  • MD5

    84fb36cabc42067e8bc2fbde92404c17

  • SHA1

    914e082f7cb963c9143d1df7b633d2178c6e611b

  • SHA256

    6b6f04dba58447058f744da6d1d2718f993852a9b60b9f1c12b1501b5e93e3fe

  • SHA512

    351e77c2286ac68f13f7d35cb185bfe1867793c6b490491f0b40db98612c2ea724190290985c7c68aa35b96db6fc6d10a5c53cfffd52e99657461d23c25b5272

  • SSDEEP

    12288:1MrOy908kxLMbGXLrXqYiUUK24MWo6IZfMH47ucREFOlRTflif1C:by1kxQb6LrnPoWofMY7ueEFWli9C

  Score

  10^/10

  redlinerosnsporadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1