Extracted

Extracted

• • Target

    aebab14385825074e263435b09e35030bf6d7d50e6cd465ea5be206abcc60531

  • Size

    658KB

  • MD5

    d2476de9abcdba3f76e85e3d164a2100

  • SHA1

    e2eb08cc8afa2024c810753d4460c841b849e6ed

  • SHA256

    aebab14385825074e263435b09e35030bf6d7d50e6cd465ea5be206abcc60531

  • SHA512

    1e08e87a315ac7826f11be6d4b87224a964b9e5176fcae71d6668df29488a1b80e3a174355bf0194236ccc0156802250841ca2fafd11710fa5aec1cd5660d0c7

  • SSDEEP

    12288:3Mr0y90kn8Gr7VmrmtfdaQdif0URjynm447zWKde8vrLA:3yNNromtFHrURenP4mK/A

  Score

  10^/10

  redlinerosnsporadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1