Extracted

Extracted

• • Target

    b55943d8174cde460b0092fc748afaf47aa653f8c47263fe45041ee46bcab5d1

  • Size

    700KB

  • MD5

    fa9f2b86cf9c24e9835b89da7d8ff9a7

  • SHA1

    a95927430f442822964978c39acc289e2897a8bb

  • SHA256

    b55943d8174cde460b0092fc748afaf47aa653f8c47263fe45041ee46bcab5d1

  • SHA512

    be09cab83c3f41160f18fff03d5b007f46b83898d5c445cae5adc6ad40bed2267c50bab7c70e8c142f26359bd9e2f6887e68f099be3b3bdc5fbfad11fa165ad0

  • SSDEEP

    12288:pMr4y903QYLFfxr1b5KrQPouZxQ+GJPiZWleuSIyYcG:dyylxhb5AbM4qZWlehpG

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1