Extracted

Extracted

• • Target

    8d26c36d7aad4c6cf8ded7f4ef66b8f19698d927ff59f4efe6ebd4e03a09b87a

  • Size

    699KB

  • MD5

    afeab8491cc55a906e832b0a9f4c3516

  • SHA1

    6360a04d8965a99b9fe5c4c2ede8264422e10d12

  • SHA256

    8d26c36d7aad4c6cf8ded7f4ef66b8f19698d927ff59f4efe6ebd4e03a09b87a

  • SHA512

    e0dc2966f4d2df832e86af1577e6f14c5856c0413308082ffd0c9de02bfee147a3db942a56a6e114a287bffaced4ae33f5a8ec82da09df8e6539617c21840c28

  • SSDEEP

    12288:UMrVy90dlZoa7WWm0p9DoNcAQg8F5lMN/ZiNXBV+1QaAeoSe+r:RyAVEQg8zlMNRiNX6CaAfgr

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1