Extracted

Extracted

• • Target

    b156b3ccc1c89ff570b4f5b9ced2edf7036a835990ac611398b29c8813e1e3b5

  • Size

    666KB

  • MD5

    c43e94e0251a271557f1de964d458f6b

  • SHA1

    9089ed5db2eb74b4f2be06bb510db2eb5acd940d

  • SHA256

    b156b3ccc1c89ff570b4f5b9ced2edf7036a835990ac611398b29c8813e1e3b5

  • SHA512

    6de80894deb16311e81e1c953d4b1fc1110d13cf6c350ae90ce63ec615be8b553f0f67c602258ccc55c815ee761c5aaea2d5614fdc1f666e19598c8037127e81

  • SSDEEP

    12288:2Mrgy90yvIEe6+k/nMvkpJQw3ccgnXNCW67groFNPp6W+MPcmfZrU0yx/wlbmBk2:SyXPNrpJQTXNCNgyHZK6rYFwUIHy

  Score

  10^/10

  redlinerosnsporadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1