Extracted

Extracted

• • Target

    ca3f55e19c40d5c8a4e3c7bc4a43f1f9998901539dcd988bd34bb9dd586b9333

  • Size

    700KB

  • MD5

    0b0c40c6da661981f11e4522b83e3c4e

  • SHA1

    1d3e6737114cd7e4ec987b0f724fc3b9e915f05b

  • SHA256

    ca3f55e19c40d5c8a4e3c7bc4a43f1f9998901539dcd988bd34bb9dd586b9333

  • SHA512

    e3b9f50ac80d2e50e6f752028637f8047beef9c549d65ab7cf28f7bd32d9ca436162cd57f94f7f9bc7f64c2adb691e52d3bc530588f4d88c459e704be364dfd4

  • SSDEEP

    12288:CMrJy90+nVBHNUBJ9D5wcAlqN+fLs26acCqNb/5qVwLk:DyjXfLs2rcpb5qVd

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1