Extracted

Extracted

• • Target

    d9eb127e0e96b4c0bd7f00433b99fe1c4163247371d62f32ccc49251b8a203c1

  • Size

    700KB

  • MD5

    11c93979b7626ee27df4310f7ef4df9d

  • SHA1

    3b35d6484c166b2f43b5c71c1735b1b5850049b9

  • SHA256

    d9eb127e0e96b4c0bd7f00433b99fe1c4163247371d62f32ccc49251b8a203c1

  • SHA512

    34ba49d8336427e283a0beffffda7c9786549c7b8c8ac819c380f808ff610e2b3a48b45d9e1c764a512ed903176df807b57615a34423900a63ea02a1650eee3e

  • SSDEEP

    12288:bMr1y90JS2uvHkqpCTJGi9DzacAMO38F/wbo0pVvw0QoS6pi4tdwy+9dXLRMV:Kyq4HBkYMO38hwboLoS6Ft61C

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1