Extracted

Extracted

• • Target

    0a92a9a50858f95532eb3096b73d24ba6d90cba9b7cdf40cdfee39be9f10e426

  • Size

    699KB

  • MD5

    72f662e99029495da4fcffaf869297ab

  • SHA1

    4212846b0ab979c40fa414b8625e34ec6a2f38e0

  • SHA256

    0a92a9a50858f95532eb3096b73d24ba6d90cba9b7cdf40cdfee39be9f10e426

  • SHA512

    f522319985e3e02a583638246b2a47ec7a867be07fc0d77c584b6cf4d8264bde8902a82e35ad9d8a971a0d951d953552e1591c29a8d37632f3cbbb9c6d6c4a4a

  • SSDEEP

    12288:wMrjy90aJIzLo0yCy2EYuVI4N7huajp8Ggaj70Tc087v5:DyVJIg0yCkpuajptgaH0V87x

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops file in System32 directory

  behavioral1