Extracted

Extracted

• • Target

    f0a1abd85807ef7a1ee95e2810370efe90fe50c5ec2f47f0d1840dd5d02c1326

  • Size

    673KB

  • MD5

    cbabf237aef77299094d12db6605b01e

  • SHA1

    e6c105df9f8ac70aaa29bcfaa65c7c1784b413c7

  • SHA256

    f0a1abd85807ef7a1ee95e2810370efe90fe50c5ec2f47f0d1840dd5d02c1326

  • SHA512

    b9b748e73df5e1b86c973f9dd7b7e5cb7d5056c13d8c39ec5714c181ad9b90243808ebd33c514e4c5675b451eeb38497f758d335806c861bcc1f7d294632f01d

  • SSDEEP

    12288:1Mr0y90zMVqbgLqjZqLy+g6rH85gKNFjlPrt/Yl:NylV+gWj4rWgulVtwl

  Score

  10^/10

  redlinefoksarostodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1