Extracted

Extracted

• • Target

    000bec8de0ae1948d1e67e804d03001de815f09341452f82d4d231dddb67955c

  • Size

    522KB

  • MD5

    4abeeec82b57adbe2cdc75a5be24b021

  • SHA1

    054538c63fc3e1913393d5f57106030016d561e3

  • SHA256

    000bec8de0ae1948d1e67e804d03001de815f09341452f82d4d231dddb67955c

  • SHA512

    c0409ad16eb62ab91266b858241f2399a63e2120b10a16b14b680231ac6a19f3ccb741a01a306547631b7b243e79ac58ddb417c5ecd23fcb238d3e164c10834c

  • SSDEEP

    12288:gMrpy90/qt7yoF7xq4iyYrwmhhC/JhuSSKL:5yiCq4iyYhhY/CSpL

  Score

  10^/10

  redlinerosnsporadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1