Extracted

Extracted

• • Target

    f6c257dc352b5e0a739b8b19821850a81941c940c055de5d00ec85ff09d6b4d1

  • Size

    658KB

  • MD5

    62361f6fe12d921218aab6d1950c79ed

  • SHA1

    df2bc9d88093c0c9756e45de3ab5aa9a6e940438

  • SHA256

    f6c257dc352b5e0a739b8b19821850a81941c940c055de5d00ec85ff09d6b4d1

  • SHA512

    3188723ceb6ea98399ec025380f5ac1bab3dd948da1bb07cc2c5716410b7281a6c66b361f81fb26bc225fb66f259ea1a581dfdbcddb13875713d1f6b917af715

  • SSDEEP

    12288:iMrky90OSHSWStvBYE9FVayJICh8Xk2UKOwFnv8fDePdZwtil:OycQvWWayJXDzVNfS1Z4il

  Score

  10^/10

  redlinefoksarostodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1