Extracted

Extracted

• • Target

    76a941f0443ce5e1e048068f73f5fe7be14950468f5caa8def5c01bdf2ddca6b

  • Size

    538KB

  • MD5

    ea7bd5ee554b36087e987347ac9b5041

  • SHA1

    f9f5212979a3a69dea340466f8281b73a2097470

  • SHA256

    76a941f0443ce5e1e048068f73f5fe7be14950468f5caa8def5c01bdf2ddca6b

  • SHA512

    cce84f604b2acd6a036a20bbb1fdce91b38d49aaf78d0a546e3b1b88ffa1ed17f8bfa72a331fe5294062e9761f9904631f888221ba932ee03038b9f28e53fa6f

  • SSDEEP

    12288:uMrcy90FAHp7NB4PjerUyaHTwW54beitgnVhNM:OymAl4berIzwWNC

  Score

  10^/10

  redlinerosnsporadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1