Extracted

Extracted

• • Target

    561c4eeb2c23fe0c634bbebe4872420812d83b922f385d1f8b28e35ee443d34e

  • Size

    666KB

  • MD5

    f3f35f37a37c17a16f583a2c6bd96435

  • SHA1

    4ea62369e5f0a24303806e471a6175a6b687c24b

  • SHA256

    561c4eeb2c23fe0c634bbebe4872420812d83b922f385d1f8b28e35ee443d34e

  • SHA512

    4727bb79045b6ea8b919dcb9bf044e2884b76aadd33e1b7db18a1b31c68ff6b447e60c3d00600f05c6ad6d28ec20e77faf196bb7cdb6e99249097cd80e1dd254

  • SSDEEP

    12288:UMrHy90MFHnpV47UdZAXbho5v3ftNj167groxNoKN+B7l6u5rUd4R/wzHXe8iaQg:jyhHfRdZKbYNNjkg+al35rHlwzHXzxE4

  Score

  10^/10

  redlinerosnsporadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1