Extracted

Extracted

• • Target

    a10929744db08997d1cdc307cd2883ceb80b1776383b518511f4040cc910b1a8

  • Size

    522KB

  • MD5

    ae1a3f0b8f8d4f1acfe98974379f6d5a

  • SHA1

    f7aad6dc50ceeaf27015185eb7c2722d32bdcd3e

  • SHA256

    a10929744db08997d1cdc307cd2883ceb80b1776383b518511f4040cc910b1a8

  • SHA512

    071f4c35798e88a4419c1e367e29b229a892d053511d4b5738b98f5007fbbc1efb973f8be7d6b4a2839168d512be61111f3a308d351144a9db9676380ad70c04

  • SSDEEP

    12288:jMrdy90o6mCTMsSWyb50323Xn7P3iqkcCrus:uyFs5450323XL3vC5

  Score

  10^/10

  redlinerosnsporadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1