Extracted

Extracted

• • Target

    afbd8bade4aa62ab02d68ac503a3cbc1.exe

  • Size

    699KB

  • MD5

    afbd8bade4aa62ab02d68ac503a3cbc1

  • SHA1

    6e6d97c0d5dc3489672d9b63447546f88b7997ef

  • SHA256

    d379a37f5c5c7b2da42166112a10412268ed904ffd5f585106cd3462c332bf74

  • SHA512

    7bb0e671fbd25c4ad7f288e9fa0834135da774612d6141926ad06d2981188b08cefe2ffb7e866a400fdbf5926d3e03cf7ae4f837da5bdc5e733be5973c499f15

  • SSDEEP

    12288:rMrfy90OechFFHorvzKdADDAjlMyAaNvj50uDmj7LBq9zjNK:cyj1h8rvu+DDKlMyT50SmHLBq9zjo

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2