Extracted

Extracted

• • Target

    a483f582aa79ac7817e7c6bf3771f25d51c1aa5f4436ac0836f98eeeb919a448

  • Size

    661KB

  • MD5

    ce44420dca9fa976c9e8660d4469c181

  • SHA1

    b68d81db8976d39d99e46cd51817b87cf2c9f140

  • SHA256

    a483f582aa79ac7817e7c6bf3771f25d51c1aa5f4436ac0836f98eeeb919a448

  • SHA512

    043bfaf0470883ae9ac62a6fe1c885ceb038a3a677f1822c180fc28a3bbcdaef48f23cc2dc37b3ff5b50add4691a7a10fdf8c0fb19314e1bd965b4d976bc5cb8

  • SSDEEP

    12288:7Mrsy901W4TUBrccz6IvnqRC5PsG6NBJjx7CySAV5T666XrfmgeQMzpvf6J2NBN:HyX4Yn6aqRC5EG6TJjRCV65T666Xrftg

  Score

  10^/10

  redlinerosnsporadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1