Extracted

Extracted

• • Target

    67a66f8fe4acbde80bf8e704fd254a04f9099fb929b852a0bc5ec355ef75a5f8

  • Size

    537KB

  • MD5

    fa4fa18dca884cd89422b649e0d67776

  • SHA1

    713c4b2dceb36bdbc8fd7e9b21685d31a735b900

  • SHA256

    67a66f8fe4acbde80bf8e704fd254a04f9099fb929b852a0bc5ec355ef75a5f8

  • SHA512

    3ea09b1acd33248d28c9f5c1431d8fdd90c14d485cef53f3530aac484ae49d71553c6ceaad6063a2192778413b7994851d5082e15a3066bbcdd82b45b813a192

  • SSDEEP

    12288:8Mr8y90GUJi9KzxvGrUMQHKwNFAU0bMXvBN:Ayui9ex+ryqwN/NL

  Score

  10^/10

  redlinerosnsporadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1