Extracted

Extracted

• • Target

    208acb1acfec2bc3f81a85939f3f8b7da41bcb4bd67c05704ea2a1b7c3aef778

  • Size

    705KB

  • MD5

    f04aea6b27d25800305d715aea4fa199

  • SHA1

    a4e876a8bf847f2ac9f2def5bb0ac06f76b4c552

  • SHA256

    208acb1acfec2bc3f81a85939f3f8b7da41bcb4bd67c05704ea2a1b7c3aef778

  • SHA512

    024db9204607bf3b8120a42455823dc1a07e1b0b97c09381c349373e79e3637e9e6487cb1086b054dc44d12a606b3c0763c75e81aff2870f6bee0305fc7724c2

  • SSDEEP

    12288:UQ8/I5IsZj2qAcsbAWDLCHSJnITSFpVudjtcKl7R9ntzafhs46FeTkH:UQ8SZ2qdD8gqITyGdhcKtntufhspFeTI

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1