Extracted

Extracted

• • Target

    4db2fb89c3836236db86b26f04732827f408a164d60468b5b7029052394df34d

  • Size

    530KB

  • MD5

    be3133127c1f9d7e9d26a2adbefc8109

  • SHA1

    e0f7dbcc327d0523d12e1a4825814f2ff4790207

  • SHA256

    4db2fb89c3836236db86b26f04732827f408a164d60468b5b7029052394df34d

  • SHA512

    c58526439ada1a75e3014fb6a5dbc470141fd8669abc7754a1c1c50481f1db7ea591317f06f1ed9870502ca47731fed211ed5cbcfbbe2585970105f9860677ce

  • SSDEEP

    12288:cMrhy90PAiyVd5vlysLFgnEEG8hVRKkjZ1qfZ:NydtVbvlysLSnRhKkjZ1qfZ

  Score

  10^/10

  redlinefoksarostodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1