Extracted

Extracted

• • Target

    128d8c84f073250cc24f194fb287ec70e74da1d0560e1f4741d9ec0dfd262878

  • Size

    700KB

  • MD5

    459504d31915ebd972ac5f41fa3a8c54

  • SHA1

    137c15974bdce3ff852945faab32e1d2b5f20328

  • SHA256

    128d8c84f073250cc24f194fb287ec70e74da1d0560e1f4741d9ec0dfd262878

  • SHA512

    b41c824cf75b602db9b230a9189f08caf34e6b033310094d9f753f9fb6b8b6672c6243d90d8734df3ebe83d08ebe8c2928a0026d493f7c61942c70d1b0203e35

  • SSDEEP

    12288:LMr+y9004F9ltceHkc3eb6rc5SxMbXuLxlEGJEK7WPeuZDeBH:Byz47VkcHY5SxMbXWDf7WPeoqBH

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1