Extracted

Extracted

• • Target

    c0fe10aaf9641f0240314095eebb0861f73f28429c8c2d27c0bb3886b2658d11

  • Size

    546KB

  • MD5

    7a8a20f4b011d174eb31c166f50fa0d7

  • SHA1

    215ebf2fc7aed67527094d174873d96b00295d92

  • SHA256

    c0fe10aaf9641f0240314095eebb0861f73f28429c8c2d27c0bb3886b2658d11

  • SHA512

    58d9a89af6b5bbdde16e0fcca907b90362ee231fc66add39b27d67e591770a11c4b4c3e12b6340e283ea4a1241be3a20cecbb3d7613bc671c526be5b5803b4fc

  • SSDEEP

    12288:rMrBy90NPFBIGO/MewealTvXsYeYJidaIIbaqAE2B6W4n0:uysWweadchQIIbaqAjMWd

  Score

  10^/10

  redlinedezikmangodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops file in System32 directory

  behavioral1