Extracted

Extracted

• • Target

    18c8890a0790d0bf85e1090ce81faa07488743045b6663e8e1ee681114d9e737

  • Size

    522KB

  • MD5

    9cfb9d1071fc46b3560748ab3b711285

  • SHA1

    8f00593ea47f8dba5072fd246292a5bc612f32c6

  • SHA256

    18c8890a0790d0bf85e1090ce81faa07488743045b6663e8e1ee681114d9e737

  • SHA512

    0e8d958e4b1a39b2a29e9668116d1ae5a51726373fef3854d8f859b801ff6be3d3a4c2c5c65e8640ef778e05e44cd17269c6dc144b10d5f8d7dd4a913ae42758

  • SSDEEP

    12288:jMrty90ljvNtQGGvSxVK6q0PmHJRtSAlbTyzYrSP:KyujvNtQGhxI6q0Pgz1TyzdP

  Score

  10^/10

  redlinerosnsporadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1