Extracted

Extracted

• • Target

    dad02fe38f925593d8a5e3d2e4ac138ff0405a0b4d9822a8b2e849c1a9c08e5f

  • Size

    537KB

  • MD5

    e66ee31a526e68915941cb6d51b8313d

  • SHA1

    7bb12f61dc434348a5a6c529fde2e02d2e56eecf

  • SHA256

    dad02fe38f925593d8a5e3d2e4ac138ff0405a0b4d9822a8b2e849c1a9c08e5f

  • SHA512

    ee9132de777d2d856372388968ccda088e7ab9edefdac3bc59ab5ba0ebf1ca76d38d7c640489e9970ce25a0fbbc32ba9e96645f93be4a782654a5f136189247e

  • SSDEEP

    12288:gMrjy90+qd/P7z3zzRGWjELfAkRSw0tUwaprRe1ARmzqDLsjW:zyGH7z3zzoENaprRe1Bz03

  Score

  10^/10

  redlinerosnsporadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1