Extracted

Extracted

• • Target

    db77bffc81af60c9fc47eb4f30d741d35090178fc9394abfe140de4efff675fe

  • Size

    701KB

  • MD5

    0d17143e6351fcc3836467c0f7712da1

  • SHA1

    f41eb3d0d29e7345cfbbf49a287d5e1be7c38624

  • SHA256

    db77bffc81af60c9fc47eb4f30d741d35090178fc9394abfe140de4efff675fe

  • SHA512

    51d803d58cf126dbf8d4629e3286833a0b6e24736a90db88556784a10e8b2edd000550a65553a6e32a85c4667d790ca17b9ecc3241e3f86ae347082a4b1140bf

  • SSDEEP

    12288:qMr9y90DUCLLXPOe1d87r0NEhlTFluMCUv8GWK:HyE7nXPNMdhl5lSQ8zK

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1