Extracted

Extracted

• • Target

    fd09d8d6f1c056bd439f8349d70f79d95b06eda5c2a89f27fb09592f97686b59

  • Size

    660KB

  • MD5

    845602cda2ee869e9e19e87fbc818def

  • SHA1

    55d69282d6e12cb49448e6e79f11f07f40093ed1

  • SHA256

    fd09d8d6f1c056bd439f8349d70f79d95b06eda5c2a89f27fb09592f97686b59

  • SHA512

    09670fc76ddb33d3de74ea8a7765e91b612dbe225d547fad2990e3cb3a2bf05927b5da9aaf61ad4896f8a64a4141280a7900fb95d7b142671bb11a42efcea096

  • SSDEEP

    12288:pMr4y90RVJDEwytjbNRRS7CDRvay3vaI9t59DrwMntCCDGft/juNXD3Q1G:JyErELN7S7s0ct5hHn0CCBoT/

  Score

  10^/10

  redlinerosnsporadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1