Extracted

Extracted

• • Target

    096a15f784cd24590693e100a065fc55625c167968d9e9ec460a437fb1894754

  • Size

    521KB

  • MD5

    ac65d6dcc06e15da3be142d706b189e9

  • SHA1

    ab4335d74adb81f2805afcd2a9a1dafd9a289fdd

  • SHA256

    096a15f784cd24590693e100a065fc55625c167968d9e9ec460a437fb1894754

  • SHA512

    0e308785688e325ff0125a838ee8c1c506cd756a0f075c0c423b3d36ac9d557ea8e574cf72bd157c5a0cc0c8431fe4a0d92c415519f0b1d5fc378e2b6c94ebe3

  • SSDEEP

    12288:3Mrty90RZ/XT6hALhyI3sGsbrLiQ0q+OfQCxrbZN:CyMbLr39sb6pq+OfQCxrbz

  Score

  10^/10

  redlinerosnsporadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1