Extracted

Extracted

• • Target

    3180f6ae841274a340259635593276434140680d051fe737af8f759bf21bfdc2

  • Size

    530KB

  • MD5

    e1ae5a4c2c9a52b78c720b2feb361aa0

  • SHA1

    039de53a0a96d488fbd079674cf59a2da863cd21

  • SHA256

    3180f6ae841274a340259635593276434140680d051fe737af8f759bf21bfdc2

  • SHA512

    0ea44b968dcdccfebe033b585b05c6b0fccd9b2ad1ec55e90f3c1d2931e242ecf462f26dc956fa709ff1c5a1871441d983a2c0a4154671291b4dfaeef431fff5

  • SSDEEP

    12288:CMrmy90/jd8g/GwjK1HWQZWAQ3Z5MThBtSu:8y4ug/BwWNszJ

  Score

  10^/10

  redlinefoksarostodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1