Extracted

Extracted

• • Target

    fe60f84bd065fd01717c4a7abef41f75db1425991fe57a4fac90a0ba420ca61b

  • Size

    522KB

  • MD5

    eecc660f698002d6f9c79a43663c1fa4

  • SHA1

    3e571b102dde37afd4e6e8bfce181363f76e6591

  • SHA256

    fe60f84bd065fd01717c4a7abef41f75db1425991fe57a4fac90a0ba420ca61b

  • SHA512

    3a1727c834f5f9e4e381a6dcc2a99460d046cf87bf24cfb9aba0e79a49ecacb5acf690c7eac4538b1a810eae87c6c1b57520974ee7e6d86e8f827bf4f5a97259

  • SSDEEP

    12288:dMrry90wqwdiWdJrMil9N/ja6qzAmYk6OpTW24BZ5/iS:CyNqWdJgmD/ja6qzA3kSBZ5aS

  Score

  10^/10

  redlinerosnsporadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1