Extracted

Extracted

• • Target

    527b6330923fc0dbcc9c673d4a3d46a23f0865a8c14fdae986b1505fae88cc40

  • Size

    700KB

  • MD5

    a75cd6eb7d6470611bb6c529f6ced8e1

  • SHA1

    7b2d31688f1b246ea0b6f432e1242eb8b789a2ff

  • SHA256

    527b6330923fc0dbcc9c673d4a3d46a23f0865a8c14fdae986b1505fae88cc40

  • SHA512

    bb3cf8e6432b12f420a4f17b8b735f880be06e67761a3f1e24975a4f69e0a59c34b2f03ec0ee2a6e379b95ee8ce35dc687fc695d7d967ba8696eed087825143c

  • SSDEEP

    12288:QMruy90YkmmEhMM9DNYcAk8F5sPgq6UxPLjGfPwYkC7Ck1:uyF5mFNk8zsPB6UFEPwLC7Z1

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1