Extracted

Extracted

• • Target

    b4835983dc314ea866f55cc1978c30849410f067c897f2e13e1212e87c35c5b4

  • Size

    666KB

  • MD5

    9f5765d98cb7578cbe0e338b6c005898

  • SHA1

    cd53eb24729f0d5282d2ffc31b5314e5d24ae748

  • SHA256

    b4835983dc314ea866f55cc1978c30849410f067c897f2e13e1212e87c35c5b4

  • SHA512

    eaf87a47527e81e09866a931a76c22bb396eda0ab4b342f4d2b97324a6837e1fe6dc8de4d485ce1a19f3b75e45341f9487b8695dfc82e27c2cc0e108e037e864

  • SSDEEP

    12288:XMr2y90a2uYnem5W0z5j8K6W3SGSvSorUBHO/wg1nX1puZ8a3aaZr:xy5q7F5J33SproYwKFQZ9

  Score

  10^/10

  redlinerosnsporadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1