Extracted

Extracted

• • Target

    570b3b528d32058ef18f58d44af7c2b1f92687f65f8232cd59c19b79177aabb3

  • Size

    659KB

  • MD5

    79e8c53e0f6c262af86d950ce1c5f0d0

  • SHA1

    0f5bec8fde71a80c05f95d3a9e363757c5642c32

  • SHA256

    570b3b528d32058ef18f58d44af7c2b1f92687f65f8232cd59c19b79177aabb3

  • SHA512

    ca3400dc5f31322bf27c1628636acd23f5c0db87c06e7f37d1c92c1da509217ef8c5db7ecac683c66087d44ec4bb4d5b704778878862de1aa8a41a53e37854a1

  • SSDEEP

    12288:8MrKy90GBGozHfGVj/ySbc/ohJUApYFZSCMtuXI6+oOTB:GyRBGg+PbckJlDCMkf+oOd

  Score

  10^/10

  redlinerosnsporadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1