Extracted

Extracted

• • Target

    8e42ee48dc00bcb6ca2e03ca155146c58b2b52496a1c465b600f10bf908bab3b

  • Size

    700KB

  • MD5

    4fdd00fa267dcf811f8b75f325581766

  • SHA1

    e8419921c732ab949c1f96f09cf4bb4d66599d7e

  • SHA256

    8e42ee48dc00bcb6ca2e03ca155146c58b2b52496a1c465b600f10bf908bab3b

  • SHA512

    afd7ffb4a1693f427bef0141ecec1faa5c131b69b8107881989c4a78f66efa97c17d0537974ab4b362e3e79548a949abb27a6d782947ff9a32359fc8cf33fe62

  • SSDEEP

    12288:gMrNy90CbHdDJuO6SOB1P9DG3cAqtt8F3+gEPWUBgCquhLtoBRPf1U:dydJ6SI1iqtt8VKDg/uhL4U

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1