Extracted

Extracted

• • Target

    a872764a700579ffa144a57d135e39bc393e640a78dcc3f9b9d0f1abfcf42674

  • Size

    700KB

  • MD5

    146262f23a06557ae09f1dca37613818

  • SHA1

    e1e6163829a2cb18088663b9a3fe02a0572c6426

  • SHA256

    a872764a700579ffa144a57d135e39bc393e640a78dcc3f9b9d0f1abfcf42674

  • SHA512

    6fa7832d98b16e76908a6d9e67f3b3f98268150391edbea3e1087ee0f538486197ba27c25dcc6abad4f9b84e44f1794893a59086bda0f0eaa04233b8b507bb27

  • SSDEEP

    12288:sMrly90wBiOJtu3h+e6imVJPKh9DMCcAD9u8F3xp2EPWUBg6quj4XV13FVTRBauM:ZytBiOJa+QmDPQD9u8VHNDgnuj4XVB2B

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1