Extracted

Extracted

• • Target

    7902e769bfd8252b5a5dcd3c9181078ef0bf0db52d4350aae056fb1b0646aaa4

  • Size

    700KB

  • MD5

    f1f6d851f71218d0dff69edea747bdd9

  • SHA1

    695ecf86586b8748444ac097fdf6343bbdd12915

  • SHA256

    7902e769bfd8252b5a5dcd3c9181078ef0bf0db52d4350aae056fb1b0646aaa4

  • SHA512

    3ed3f41249bb6768ac374b0ff7d6d00201a515f2fc4aae877fdbe33c9abb41a295cc65bf3a12b35ec5ee70eecd4a75c8d980ad5c5384f3b493612b90719eb3d7

  • SSDEEP

    12288:FMr7y90CBD/mDf78Hryjq+9DNEcAMf8F3wJqN4xs5sNOt5FBRGaIsl:OyY7WyjKMf8V3EsaotvBwaIe

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1