Extracted

Extracted

• • Target

    e3c8b76125ee15f831acde8308cd6fd20f3c3274b68660c74eb4dfde471a117e

  • Size

    660KB

  • MD5

    fee54abada9812c3004e99bb2fc14349

  • SHA1

    1aaff0e336a254406a89a70e6091ae86f6658646

  • SHA256

    e3c8b76125ee15f831acde8308cd6fd20f3c3274b68660c74eb4dfde471a117e

  • SHA512

    47a0c5afd983219886a0414a5692ccce628989230cd438cff6db56271d29e1d83e087b3da7e6b7399c48da833a8ac2fbd83a7ebbea7d7e67a26b1e5bfe76767e

  • SSDEEP

    12288:iMrEy90f2RMM3l7O+vyfVm93m1v+FRWApDO1JtK++n:SyQZM3xO+vykVIJtK+s

  Score

  10^/10

  redlinerosnsporadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1