Extracted

Extracted

• • Target

    71bdd53f99660890f5d617c5f15a94a966983f0409f002282bc924d6e4e3ec22

  • Size

    522KB

  • MD5

    fa38f2fc765f39fa951b4521f56dec11

  • SHA1

    b69b5cd8619c5356d90905caff700e0172b5a44d

  • SHA256

    71bdd53f99660890f5d617c5f15a94a966983f0409f002282bc924d6e4e3ec22

  • SHA512

    862a6db1fe8c2043e684231b132ae5b11771ac699156f0b6744ad749bde766e38573b4d1d33bcd993106cfabf7c18c2a2789c5949450ae468f787644f37937cc

  • SSDEEP

    12288:kMrBy90rQOHmqOX6s3QpTQuzRW8IF4SmzWKGOxuHuohezTX:Nyx88X6ZpT7VIWSfKGPueGb

  Score

  10^/10

  redlinerosnsporadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1