Extracted

Extracted

• • Target

    b7b1e5a74ed7024ebd876b849469d2258eacaa3a709e9d930d80a43df6a0ac94

  • Size

    538KB

  • MD5

    e897d6c60d74c348e336bf337e9d48f7

  • SHA1

    2b55c1e23b16afb7d50baa9f49b3bf9dcf699e23

  • SHA256

    b7b1e5a74ed7024ebd876b849469d2258eacaa3a709e9d930d80a43df6a0ac94

  • SHA512

    2fe01439ac971fb9e65427ee3721c92e7ce3e866c39b8cffaca6ceacf0e33dd50a67c51b93553273475367a795692a08efc0d9a321121c5d569bc7ad86b287d7

  • SSDEEP

    12288:zMrwy90HcWOAcgZBfFBo/QgPMWnuAQbaIBBjpq6iq:jymDOAcENWYKM1Ta6q6

  Score

  10^/10

  redlinerosnsporadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1