Extracted

Extracted

• • Target

    02bbb6b520a27b16237e0cc67d9a07f4bcce2f35b38064e60a16a0ee536e9042

  • Size

    699KB

  • MD5

    481bef4c1c764bab725678be432ce10e

  • SHA1

    687b14d17555ec60c9b50dd73d40e93916d8fdde

  • SHA256

    02bbb6b520a27b16237e0cc67d9a07f4bcce2f35b38064e60a16a0ee536e9042

  • SHA512

    66dd4763c599c2cb90c9152d6e7680f5e241a6fb3d8c670a4846fdb7394fe525601003f42956cb8c4e76483d78825b48b94027baeba19819ed7bdabc36c95522

  • SSDEEP

    12288:LMrpy90J+ww2GAV6+89W37LlU/42Nifluej7p07vQCx:yyq+PAN89WLLlU/uflueHp0DJx

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1