Extracted

Extracted

• • Target

    f510fffd757f4863fd73820385399ee51e0b60cda02c695cb7d0221f3e2d386b

  • Size

    701KB

  • MD5

    63d0d1bb3c0ce51b690146d58304feb4

  • SHA1

    cafa21387f901bf2981b7f562b6fed5c765e2093

  • SHA256

    f510fffd757f4863fd73820385399ee51e0b60cda02c695cb7d0221f3e2d386b

  • SHA512

    596230f81a051eefec30e19128eb848158afc594e41ba6d15c84871dfccc03cdafda5c24f41e99dbfcd6ccf60d113935cc1322414fc7438c2f94897677e9c921

  • SSDEEP

    12288:gMrDy90SHuJBnI/Z2uV5PPCu24u/3Fm9rB5531nk0t++van:zyYnaV5i6EQ99vLtRvm

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1