Extracted

Extracted

• • Target

    6d5ec36015e0189a13b8a8e5b13a4a153baeb42b1806f3b85d8dbd824d0047de

  • Size

    658KB

  • MD5

    715debc02d729ac0871cec3158c04b61

  • SHA1

    64f4bb6ff4e84ac1b30d63fba86037fed22b8785

  • SHA256

    6d5ec36015e0189a13b8a8e5b13a4a153baeb42b1806f3b85d8dbd824d0047de

  • SHA512

    26297e1ea03cb72e7026add9957af35bf532aa2bcd4bdc77f692badf1a97ba38b8621fadd37e50634dd64c63e7f3b141dd43d153b30b9b6cdea019baec90c9d4

  • SSDEEP

    12288:BMrvy904eMMNZQnBUUj7TUajC4hlHVK4DFcklnwfoio6lEwA2iEfWVmA:Ky+MMNZQnBUUoCxyInMPnTw

  Score

  10^/10

  redlinefoksarostodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1