Extracted

Extracted

• • Target

    12e1eb5f3c7f829cb225d6b2c5aad4b8930bcb10319668135c017f338e8caf8d

  • Size

    700KB

  • MD5

    b4e0c34a319e1fabf653c76d31563155

  • SHA1

    9819c9959249320ee6c94f97a59ea2eec9edfc70

  • SHA256

    12e1eb5f3c7f829cb225d6b2c5aad4b8930bcb10319668135c017f338e8caf8d

  • SHA512

    fc2b4a9e42cdaba670622bcf7fb635d3be29a41d7d2844c3b3b9d7be671f69778a3fbdb8af61a2f53e17da8ee44407202548b58cac11e71f39615c8260f9c6b5

  • SSDEEP

    12288:uMrZy908RhZJZ5nmxBC9DzxcAvp78F5eaXcTBen8JqVlYNthlTcaxY:fyzXrmxOR8zea208aghmX

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1