Extracted

Extracted

• • Target

    c893a399acbbbbc679e8a8f75807109e41c4d69de577123e516b27272d59a914

  • Size

    522KB

  • MD5

    7dc61ca503e5c0f047b4a711f626590d

  • SHA1

    10d5fb10821cac867e494c72fb6f5d851f7ef68a

  • SHA256

    c893a399acbbbbc679e8a8f75807109e41c4d69de577123e516b27272d59a914

  • SHA512

    8e450f167187098fa5b151bd07043da6e4675b6d0efba7c1e43bfe49764fae974e68ec668b8a94ba76aefbdca3c8878aa1ec0f2aef92fe1de77b3e48e004e3b0

  • SSDEEP

    12288:yMrTy90A8QGZFeXkFg66Sn7h8DW4hQzWNgNoPIpN:ByfcIXkPKDfhZNgNtN

  Score

  10^/10

  redlinerosnsporadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1