Extracted

Extracted

• • Target

    19a0fb4fdbcfd9f3097242120529b80f4b6c3e07a06652126305e8c659cbaf79

  • Size

    536KB

  • MD5

    42e850809c3ea61f97af4dda73cd9cd3

  • SHA1

    a9304367bf5d8654e50815255315810fb8b46f2a

  • SHA256

    19a0fb4fdbcfd9f3097242120529b80f4b6c3e07a06652126305e8c659cbaf79

  • SHA512

    fa642414b43c05fb838705cee64dc233f9da3456d53b9ccb160ab86ec54ce1a41917d04fd61978fc95ee1f6cb9951f9aa635f0e012c647de63b85d157e98d8bc

  • SSDEEP

    12288:zMrly90Jso2AZ6eKJPpflW1qNazY2XgL3NO7s9q0+NOR:Oyssob6dbNaPgzNms4Ne

  Score

  10^/10

  redlinerosnsporadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1