Extracted

Extracted

• • Target

    c22ec999c86e2bb35782a82b70fd9750666272175974b921b9c1c4d6cd1dc91f

  • Size

    537KB

  • MD5

    d6e177a1a2724bc1c6bcf5647cc569e5

  • SHA1

    cdcd49d9833e10a72ab27416071d509447c3eb8c

  • SHA256

    c22ec999c86e2bb35782a82b70fd9750666272175974b921b9c1c4d6cd1dc91f

  • SHA512

    ff2f5ddceba27fca53a4011f9f77b806e2a1b1e3e619dedbc5e99c13c928e4b83d651b4e5063a0c586fa02188b2cd4cec30b0061b86699d39c2959bf03036e79

  • SSDEEP

    12288:/Mrwy902/FPQ9u0zOxEoPVfN6rUeMHYwCpdWp6:zy69u0zoDN6rc4wYA0

  Score

  10^/10

  redlinerosnsporadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1