Extracted

Extracted

• • Target

    7df5cb8f012ff16f4ed1f10bd10c331e2f06baa7240248dc488884af1ec7ffef

  • Size

    667KB

  • MD5

    e8922b25e53685d208ff8028675c79ca

  • SHA1

    d0b8add421951a07cdec5fa2ba74845bee45509a

  • SHA256

    7df5cb8f012ff16f4ed1f10bd10c331e2f06baa7240248dc488884af1ec7ffef

  • SHA512

    dd3263d19d4be27af9d10f7be7e2ba18fd3192241edc8a3bf1263c054484c5de8699abff91b7451ec4bfe2cf7c8b65f753319667e5945d8232109ad508d1cc81

  • SSDEEP

    12288:vMray90vqqUJZ/Dde4LsVo/yitKa32nDkKigTKiPKxTlQohRKXYfg66XndSFvV:BymOJVdY6MkbgRixTlnRKXYfg66X0f

  Score

  10^/10

  redlinerosnsporadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1