Extracted

Extracted

• • Target

    56023227c8946e1b954c03a5f2f08915.exe

  • Size

    694KB

  • MD5

    56023227c8946e1b954c03a5f2f08915

  • SHA1

    5763e0b9937a38c487890f1d8c194422239e9c9d

  • SHA256

    a9a3d706b6613786203e321fd54fc9988843dcfdd823279657f811cdb80bfb66

  • SHA512

    9d54f8fe2016263ab9e1f7facbd7e024eb26c13b0f3f0d447ff76cf292bf2cccaa9ab37432b9903eabf9c77a5113bb102f678c4f81da9866a6160db46321eca4

  • SSDEEP

    12288:BoK7SPhtwSwKdNGHv+3jk5I00xBFQjwnS1PEqvMTsPpD6WdpB:ru5tjwKd0HWzk5NcKZEqldFH

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2