Extracted

Extracted

• • Target

    58fac1be2bdc06ebccf203d2dfd4c1288ec9913fb4f103974a9e92d6d8238907

  • Size

    522KB

  • MD5

    5ce84ae89cc5722933b890ddd141adf9

  • SHA1

    bd6bb28ab0a911ac269b85e83dc6f29a250dbefd

  • SHA256

    58fac1be2bdc06ebccf203d2dfd4c1288ec9913fb4f103974a9e92d6d8238907

  • SHA512

    bffb9859e79bcf7adc5852503c928f6856d565328f380ff3084da02ad9f8ceb50d921b66194325512b86930e004e5050e07f87cb892abb0e4e642d8c509ba8ab

  • SSDEEP

    12288:6Mrjy90C6bLWRvctywZN8q14BqzW8uF/3XHCJoSq:Jy86YXwqmBzb3nt

  Score

  10^/10

  redlinerosnsporadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1