Extracted

Extracted

• • Target

    e768bcf4eb9c3b5c594c47b1148e83325c4d5449e8365210943d7ba831043baf

  • Size

    546KB

  • MD5

    30fc1c82ca4b3fb3fae40e7b78448029

  • SHA1

    0341a2e04c42a5cb454824ffed1f30b91ff0de1a

  • SHA256

    e768bcf4eb9c3b5c594c47b1148e83325c4d5449e8365210943d7ba831043baf

  • SHA512

    8a35c706e94504cb17421dc5616df7a87d06c30c2da697cc1dcff43be2918b082315669f13f395edcaa36c71ed3be45a24ccc559ac7ee8923c826e94e6cf6435

  • SSDEEP

    12288:LMrBy9004uIqZnx1erkQ2gpzvpfGIAcrPlgRxe+U+/mKbB5:uy5IqJxcAXojp+I9b8xPfbb

  Score

  10^/10

  redlinefoksarostodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1