Extracted

Extracted

• • Target

    078c888df5a4c8b2cf3b7a1bbe64a9c3.exe

  • Size

    535KB

  • MD5

    078c888df5a4c8b2cf3b7a1bbe64a9c3

  • SHA1

    63bd4f6e0a067e9e29f148dcc22f1dac7a53aeaf

  • SHA256

    c057850344a23fddd2577d073c708dfb8effda80821b5e1426b9efc5456caecc

  • SHA512

    ff486800bda3b049940cfff2bfb6d090e4bd95665144b318a9267456e0a75daa977fcae1b755d969508a29e73b7c7531bdd5907190255edb236eb53465c30325

  • SSDEEP

    12288:aMrvy90ep2DVtivsckZMi5GFahCZZ/JoE1vWLfv+Eovm3xEI:ByRpMVtqkBX8iE9OvTpmI

  Score

  10^/10

  redlinefubarouchdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2