Extracted

Extracted

Extracted

• • Target

    02f214770c27b04ef210bcb23c59f1e8a08fdedc87dbb20f73df51e85809c629

  • Size

    852KB

  • MD5

    0d3d69435046ce051ce4d5808130c3a5

  • SHA1

    09692132b80b84f4ae4fc873b365d0d506691e53

  • SHA256

    02f214770c27b04ef210bcb23c59f1e8a08fdedc87dbb20f73df51e85809c629

  • SHA512

    2eaef22cc2c81becb7409ddc4b2e6237b43befb4ca8559970a5febf41ead875d1f6b9a610b37209c6d933bd66f548d1e64d85d02bf8795b9a4723c157907eec4

  • SSDEEP

    24576:vy7otIHOBBntbEn9VT5VcE6b9Iqxt9JN4rq:67oIHkBnyrc9Iot9Yr

  Score

  10^/10

  redlinecr10ndubkarumadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2