Extracted

Extracted

• • Target

    534acef50ccd536579cb27f4a2ff9970498ec293829e5826f9ce2a183ae87e41

  • Size

    700KB

  • MD5

    dce700c6a535804f84114ddc561acf26

  • SHA1

    191d8567a6ad02eae2de6b37944d85f8d211cf9d

  • SHA256

    534acef50ccd536579cb27f4a2ff9970498ec293829e5826f9ce2a183ae87e41

  • SHA512

    3d2a023fbcddb643462ff1a06f07bc122db57cc9e85c857583bbb613bccbd8a9311ea527325bc76a3365e3f8c13cfa00d2c1a8bc590164f6b3c4cd9a8e5798e9

  • SSDEEP

    12288:rMrby90LBql3YZ2yKylH9D78cAl8FgL06TmroTAXBR9cdVNeqCUM:gyuv20gl8WL0ymnXBiFCUM

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1