Extracted

Extracted

• • Target

    d1224fc62d3055931606b7b37bf66950666f198517f5cd1484671dc5eaedb2dc

  • Size

    521KB

  • MD5

    3fa79f8ab0208cf3ff5d5248c4e31fb2

  • SHA1

    d7b96f78bf2c6c1914cdff318b8e3eacfce9877e

  • SHA256

    d1224fc62d3055931606b7b37bf66950666f198517f5cd1484671dc5eaedb2dc

  • SHA512

    fff7ee9f7cf888e88e3b62c048355d804540711029b290b673baf5368c2cb733704ddbca01a309e3811735e5c0fd047c9c41189a2dfa96528c041c8a750300d9

  • SSDEEP

    12288:hMrIy90nOBC5A7F+2iz7pgP9RJCHWHIQ:9yAd73IRIkr

  Score

  10^/10

  redlinerosnsporadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1