Extracted

Extracted

• • Target

    0fbe9f6d5082594112e49b1bcb336d1c.exe

  • Size

    689KB

  • MD5

    0fbe9f6d5082594112e49b1bcb336d1c

  • SHA1

    cf85b27cf92a0b5ac20c68eaf8f3c22ffbcf50a2

  • SHA256

    f7adad79623135943b39e437b5931814e60ddf828f69062c53d6dec7c791501a

  • SHA512

    6f785b509621a55b8e47e5ce1937552b32edb0d2ed73407a856a495d9b3764e0376de32ed531dc2574265bc95c0220408ff94f4a91df2df9cefa330b817bbe33

  • SSDEEP

    12288:XMr1y90bb7fYBpT1tXp4y+65hLuaHyMSKE3qnFdGIv+6WvmFdVfig8g/9XlPx:GyYqT7XDlfaaHyLt3qG6WidVag8g/9XT

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2