Extracted

Extracted

• • Target

    0cf02ef738552e6bac13ee563124655c61aad375f6dead85780609996a2a3c7a

  • Size

    530KB

  • MD5

    68ed5e29b084cd534a7c3d4af2800f15

  • SHA1

    6236de7e92d2e4a85c53ef75bad5b6d6bc0bc824

  • SHA256

    0cf02ef738552e6bac13ee563124655c61aad375f6dead85780609996a2a3c7a

  • SHA512

    49557888408206923ccf4da88f99513b2142a810fd3aa58e08051aba02b0d51561aa9a889e46bd7b8759f5c84825786282c40d543ef71a6c1a47b91ea8230f8a

  • SSDEEP

    12288:zMrwy90WCAfm0Rao4lMYAd2Bf5KXa/tm1Qbn2B8MCqlXoNKQ:TyBpYo4lMYGUA+m1Qbn2B8MRoj

  Score

  10^/10

  redlinerosnsporadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1