Extracted

Extracted

• • Target

    9746f0f7391dff4599e5e2c783bf44e9d9021a5f961296005261e6de69bf6f04

  • Size

    521KB

  • MD5

    175b0fa6cdffd9401b790672025619d0

  • SHA1

    fb9e5eb6af611aba4aafd6a4095fd4b214a5dc5b

  • SHA256

    9746f0f7391dff4599e5e2c783bf44e9d9021a5f961296005261e6de69bf6f04

  • SHA512

    db654098d5e9d2a866046dc093c533ed9fa49dace7ad4f4754cc7839f9d39796a212ccb5918f0c8e1553b0827411edfa9bbe30a48a1ccb0af4f2ccab85ec6008

  • SSDEEP

    12288:vMrRy90r6MAJtRTKaE77jH05ZIQCs6rLi29IFMLAbuEub/7:my2M4aE3z0rIjs6629pAbuEubz

  Score

  10^/10

  redlinerosnsporadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1