Extracted

Extracted

• • Target

    b939bec06705ccefce12b0b160715ff10cfbf2855a0f07e913efe90edf1f9d1c

  • Size

    658KB

  • MD5

    6c717f593f85a5ef528d58e6e550c789

  • SHA1

    6acf6d99050e028a1bc704569a8b9f1577f9626c

  • SHA256

    b939bec06705ccefce12b0b160715ff10cfbf2855a0f07e913efe90edf1f9d1c

  • SHA512

    2301870c60599c9da13202a1c9658a1676e130c0fe22f6a543d6a329c6c67095f7d586d57f4ea6c3cf5123402843143342a8c038cb8e656f4866d66f5649243b

  • SSDEEP

    12288:dMr4y90i2dE9vjbllyuJH9F19ohUXX15F5Z/jp10ZVRPgFX8Qmc0WRH:Ry1ljbllyQH9wIt59UrPmX8Q2I

  Score

  10^/10

  redlinerosnsporadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1