Extracted

Extracted

• • Target

    644ddf487ce0770598b0c1cb27f80c46c1fac9fc4f0c247b17b9417d0d6cfbbd

  • Size

    701KB

  • MD5

    214d113f313941dddc10a1f078f8cf3c

  • SHA1

    689006644698d4cf4645b9a0ee2996d41ed663c8

  • SHA256

    644ddf487ce0770598b0c1cb27f80c46c1fac9fc4f0c247b17b9417d0d6cfbbd

  • SHA512

    278cf9b091c541b73e5f6e6c902a3450aa6bf2272d85b1b2b203eb0efa12091e6ebea71c302a8d3f535c62151b8d38535b4d3db352e0daead65516cac2dcf94f

  • SSDEEP

    12288:zMrjy90Me0MUq8jTrid0H115BSPCuF4dC2Sw/coUy7WMnpgBPi:UyfezUrfHBBPBd1SuUySkpCi

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1