Extracted

Extracted

• • Target

    7f0ad6c53a7c147a5a238303210009270100ddbca15af6bbeba6a0484b23b427

  • Size

    666KB

  • MD5

    c5c228b71368d3ff314d0d098d5f7670

  • SHA1

    09fcb91518b97879e6e47c1b6e30b9bb3d827e96

  • SHA256

    7f0ad6c53a7c147a5a238303210009270100ddbca15af6bbeba6a0484b23b427

  • SHA512

    412da0b7f004ee5eb184ffd1ce30d724996351f936d9658f6e32ef41c413433aa3e941a0757f77fd1b08105cb290c50a38738d5e4e2ed1e4797b7a2e5efc1641

  • SSDEEP

    12288:kMrIy90CdET0If8X8ShzqirLSygtNaS67groCNTKNv4k+L+UBCrU0yM/wXTUi/OF:cy1F8ShzqirLMNa5gVvkc+UBCrYKwXTM

  Score

  10^/10

  redlinerosnsporadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1