Extracted

Extracted

• • Target

    19b855788a90190327fac4fa30a09559089f6208a7d09ac2351302dd146ca756

  • Size

    667KB

  • MD5

    49e80828e0dc6112327ee85a4e7be939

  • SHA1

    f269752fd14d8e4cb78d80c5add75bbee60b260d

  • SHA256

    19b855788a90190327fac4fa30a09559089f6208a7d09ac2351302dd146ca756

  • SHA512

    e1bfd41eac6c3c7877db4e14c57383ea0ac01ffd60fcaf04168fc4ec613daebb62f7b27b44bdb74dbbd44986fca3bda12cda65034f9a13ee6290ee9bd26675e2

  • SSDEEP

    12288:9MrKy90ASi5DBqqWwJkGexBAk1g3P+U6zWWqI/CLThHtLmIqBCC3/tLH:7ywi5D0qWwVudefwzobtCIeCA7

  Score

  10^/10

  redlinerosnsporadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1