Extracted

Extracted

• • Target

    e0accc56d2710fdef55b0a6c56b0df48655125b21373e73db72fe90053f4f622

  • Size

    521KB

  • MD5

    54bbd7e1ddb745cf7bf4c9b6f9d6598f

  • SHA1

    82cd0112f200c6babdd8162ad55353ee258d181a

  • SHA256

    e0accc56d2710fdef55b0a6c56b0df48655125b21373e73db72fe90053f4f622

  • SHA512

    2cfc4513667c775830e0fd86ea22721e00c28f563deab9f82669a6c11081b336145dc00ed5c1d97f8ef48af9e2b7eac638a30a2df1638828bf064f27571b3a50

  • SSDEEP

    12288:CMrIy90tMEZafFLiaBtxOkbtJl6RizsjfOO:6yWjZafN7NOkXsPj2O

  Score

  10^/10

  redlinerosnsporadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1