Extracted

Extracted

• • Target

    d4fa47022155f34dc0d01dbdad0497c9edc4dc0eef8c3e79db64c85a4b583186

  • Size

    700KB

  • MD5

    2ebd2884c9469457bda795909c9f04e2

  • SHA1

    de041e88502b3947b171a90c5faa7ef36e59c1ac

  • SHA256

    d4fa47022155f34dc0d01dbdad0497c9edc4dc0eef8c3e79db64c85a4b583186

  • SHA512

    8b80a8bff7d0f1612d8810413acb47c41960991569457c3b1302fe9fdc217dfb689eb1bcddf74c1e8005b32bd2d10034e6a0835c2d5486ae21d90f4e590243b3

  • SSDEEP

    12288:aMrpy90gd47BTMF3FfjJp9D7tcAZ8F5pZ/cchf0p0fvm0JDNd:by+arLNZ8zpZPhMp0fe0JD/

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1