Extracted

Extracted

• • Target

    145673b80f8dfa7082193739702e40566349b59e38bd0d2413b93dd9cb569e06

  • Size

    522KB

  • MD5

    6f8bc8c62d187c8f2b8525fde9e6406b

  • SHA1

    ca69236ac0f041d434b9aa0150c2e03c1a7d4ff8

  • SHA256

    145673b80f8dfa7082193739702e40566349b59e38bd0d2413b93dd9cb569e06

  • SHA512

    45bc7211fc5d04e8e80cf7c6c03da38064850f12bea3cb36cee56efde1aeb87e62ea377066704a8633cb94071f0f2ab54d2c6d768b3334cc1aeb6bca0ed80200

  • SSDEEP

    12288:cMrey90py6niTlFb/YXllz42fDBh8gK4wgzWVwrtvV7ntDR:aycODbClZbEgrwpVm7/

  Score

  10^/10

  redlinerosnsporadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1