Extracted

Extracted

• • Target

    b9552e1aedabaa695796a646096927361969b50a9a46bda71ba912608bd8fef6

  • Size

    666KB

  • MD5

    f2548d932cd1db81a282bc8871b413df

  • SHA1

    5b85c67789fb4720960902c58c51e731e38b46ff

  • SHA256

    b9552e1aedabaa695796a646096927361969b50a9a46bda71ba912608bd8fef6

  • SHA512

    809b65fa72a149dcd04804f9ce43557b4a17545894c364f430b4351ea253d5004e3cc4f736d8212237d6255fafc77e3623e86a9ff4c9155176dc3ad204e3f9df

  • SSDEEP

    12288:KMrmy90lWPTuWvmXDhOcmgHQSbTHd6HN8pJV0rUs30/wv50Ujky6oUK/7:AyWWvvcYAHdcN8qr1CwPf6E7

  Score

  10^/10

  redlinerosnsporadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1