Extracted

Extracted

• • Target

    62ac5ae23210e52e5d25b84b20c156b4b8ec77a0af0b42f76ee32078a27611a6

  • Size

    700KB

  • MD5

    5152d0d019561b65b01749eb4276ce84

  • SHA1

    d95293451b7fd2008b5113bb70f55ca13cc96685

  • SHA256

    62ac5ae23210e52e5d25b84b20c156b4b8ec77a0af0b42f76ee32078a27611a6

  • SHA512

    e2e479766b727e9e3eb42f2554a4ae9cc402a35f9644a656a0ac0512d26d69b9821c9b8cba9691956a1e0a29fd32f8d00f92da8e332e513d9718d623859ec216

  • SSDEEP

    12288:KMrfy90UWjTQnt1z9D/GcAo4NkN+qOgolhe36ndRt:1yzAymo4VqWP/nPt

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1