Extracted

Extracted

• • Target

    2b1a05fad072490bd840f62cff9b001fe25a6a1c722f1dcab47b90385dda16e5

  • Size

    530KB

  • MD5

    25e6376661841dc2dd9e614a6cbc9134

  • SHA1

    96a7b84f82448214c21f3a53a6bd8cb66b32a5a7

  • SHA256

    2b1a05fad072490bd840f62cff9b001fe25a6a1c722f1dcab47b90385dda16e5

  • SHA512

    cb95dd41927499049f0ca0d04192aa389108759d2feb059ce39e4cf806f1277aab34bf6fb74a0cc167eb40dbcaa1e74fba8fd45eb23c52fdf62c650f4b6e6c05

  • SSDEEP

    12288:wMr2y90YuDG1lytJi/hKlw1LJE9e4NO1/9jQ183U:WyhuSHytJ8c2L+a/Fu8k

  Score

  10^/10

  redlinefoksarostodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1