Extracted

Extracted

• • Target

    a18fe29eaac9c5ebc8a58ae1c56d1edfbb9aadd80366082f9938ee4645063fbc

  • Size

    667KB

  • MD5

    56f8e2611b607d29132376fd7a4b5fd1

  • SHA1

    7310c5dfd5478255fe8212c8f359b50512240392

  • SHA256

    a18fe29eaac9c5ebc8a58ae1c56d1edfbb9aadd80366082f9938ee4645063fbc

  • SHA512

    9bf5fe8c0258226af0ffe5418d78f0359a89507fb59336464c1fd87fb88d9cafbf01c9a4d84cf1f03019629cd81f83bf6e393c58ba54bc4d45649be6d9524eaf

  • SSDEEP

    12288:RMr7y90X/seC0qsFzbwPWlyi383D8IDascJ6Ue2wck/XC:uy4/slsbHs34hJ62wch

  Score

  10^/10

  redlinerosnsporadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1