Extracted

Extracted

• • Target

    0056d8126f4446a814f3dabd6dfce5b17cb28da36b9c7df5650660bf45742965

  • Size

    521KB

  • MD5

    cb801e914b1ad210cd910d3787ffdc5c

  • SHA1

    413d412288a98b199e4a9f2ffaedc0e658e12eea

  • SHA256

    0056d8126f4446a814f3dabd6dfce5b17cb28da36b9c7df5650660bf45742965

  • SHA512

    daadf0c856965ddd7bbe4efe5d601ff6a98051c8ece81ae44c1776cb6fa015c249034fd64971faca9a225a7e60cf2222542704af2e4d427e0d3a910f31c3a5d1

  • SSDEEP

    12288:bMrny90dkqTD6LZf2+CcAP8Q932Hk+Fe7+msz5E:cyfCP+NQ932HDcJGE

  Score

  10^/10

  redlinerosnsporadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1