Extracted

Extracted

• • Target

    b0a22e671152ca720b1ef2e03a9735e5386322370955ae1c98698d34dfa40699

  • Size

    658KB

  • MD5

    5f0dbdf98ecc6f5bc1e8fae21740f509

  • SHA1

    2bcc621fa11247b324d44157b3df0e1ff932b2a8

  • SHA256

    b0a22e671152ca720b1ef2e03a9735e5386322370955ae1c98698d34dfa40699

  • SHA512

    da1a3df624ccd67c41758a606f9896ca0b48c47261a2c32ad2040219367fe34cfcd1e0b3bca13974068bcde1c4a658e658dafc3b0219232dfc78bb9b1cd09019

  • SSDEEP

    12288:sMrKy905O3aOEpQx1t+XHQ7/SxIBAU446zWKnV8vK4Qh:+yCUREax1tAwDSQAF4DKn

  Score

  10^/10

  redlinerosnsporadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1