Extracted

Extracted

• • Target

    64bec3fe65069e5f7b005133c647aff0279d37f1e7d33ae2528b87d2e48fe108

  • Size

    522KB

  • MD5

    d98275270bf1591b019ce147dd9f2210

  • SHA1

    bf5ec6fe766cca1ef5d30578b11c7c3b0ed398fc

  • SHA256

    64bec3fe65069e5f7b005133c647aff0279d37f1e7d33ae2528b87d2e48fe108

  • SHA512

    19e690438a2c91cc235b86564d81b1e978f507e5bbe9e19f77c146e1fb5c07840e07c68e204d5d43bbbd805aeeacf715a79d3867808d15fd4cf63f00ee01663c

  • SSDEEP

    12288:zMrZy90I3rKYxZ/qXorwO4hCfJnQg/US66lOmyi:yy9OYxZ/6o14Yf11HYmyi

  Score

  10^/10

  redlinerosnsporadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1