Extracted

Extracted

• • Target

    8285cd521d93b1ef2d6e148f3384aba044fc977995cbf71eaa3f7e93df15f498

  • Size

    522KB

  • MD5

    8f12f1e2a1972175f195d2faf92a7962

  • SHA1

    d87e54a5a572bd62d0e489c7fd47e95d33063c48

  • SHA256

    8285cd521d93b1ef2d6e148f3384aba044fc977995cbf71eaa3f7e93df15f498

  • SHA512

    cc898877c90a3883d117caadf91fedd04ff3129d281ac8bd1d408d32a63abe18394aafd2709e1c5b34389a587218e25440d70e110a3fade9429f04374876321b

  • SSDEEP

    12288:dMrry90fxf3YpsvosLiJ58UF4uzzWPwr01kWFdLVp:uyy3A/slUWuuPwrp0p

  Score

  10^/10

  redlinerosnsporadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1