Extracted

Extracted

• • Target

    f4fa09df2746790c294308559b666ef29ab66580ced4f60db223e99ff86d4170

  • Size

    531KB

  • MD5

    b167516dd3fef7aedfc4ab530192076b

  • SHA1

    138645c1bce444d62afb8e72a5bacb3b4b000bb2

  • SHA256

    f4fa09df2746790c294308559b666ef29ab66580ced4f60db223e99ff86d4170

  • SHA512

    6eb0c713e68e67cb30acd42c07301a28c03fde036ef10a4d365b431944fd0c3318a527b911f355d04234e150062e94308c6cd76de5699ddc6b31c332b4334115

  • SSDEEP

    12288:sMrny90SKalwL+SiU+ectklnwfocop/w4CyIa4gGxwbkd0O2XR:DyZXwLJ4tInMVIb4gpkdFI

  Score

  10^/10

  redlinefoksarostodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1