Extracted

Extracted

• • Target

    0ace57bcf4e7f842c56d083f65c9e9178ae1f635a81fff71a052d529d28bbe51

  • Size

    546KB

  • MD5

    45078fad0bff506cb371dbb6bf2b3691

  • SHA1

    5a509b5a8bcc84d6e7673e4e66d35c74dcfe58a7

  • SHA256

    0ace57bcf4e7f842c56d083f65c9e9178ae1f635a81fff71a052d529d28bbe51

  • SHA512

    9e4ddd26b17254c405ab734175479ac262aba3a60c40e9fdbc1d114b5a7dafe155e45d8e13fa652c79ff89ae3b0506ef22af442cfd64139e97738c2a7194975f

  • SSDEEP

    12288:KMrJy90i8P55UUEufxE92gpzvpfG8AYrPlgRxY+y+Imee/C:Xy1iRX7ojp+8Hb8xs2/C

  Score

  10^/10

  redlinefoksarostodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1