Extracted

Extracted

• • Target

    0cad2cfc06b38439809d62e1c5ca38068fce11b1442dbdb4eaa32e68c2914b55.exe

  • Size

    686KB

  • MD5

    a9f1d139268416c799550a0741aeadbb

  • SHA1

    a2c3f3ff9443023114b94add4f7a30c165edd50c

  • SHA256

    0cad2cfc06b38439809d62e1c5ca38068fce11b1442dbdb4eaa32e68c2914b55

  • SHA512

    98c777aad810b357603e82505fa13681ebe777f71cdf6d4a94a7272f9516429d3b338f3256b12d9d41855725f73964866db227bef6cb18c69bb3e8e377ce59d8

  • SSDEEP

    12288:9MrQy903BCHk07CUdCa9RW4mTc73ZR+OYmMJuH64N4k4kk+B6q9wcK:Ny5XeU00+JuiiDDK

  Score

  10^/10

  redlineborisdogmadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2