Extracted

Extracted

• • Target

    e45d4f49ecc96f0f547227a02f637f7c9efffbb707a3d6e925ae1c59058be757

  • Size

    700KB

  • MD5

    545ae6221d77b17dface82c531f1cce9

  • SHA1

    2b5253d1b21c0f7d38e6fca82cb5a1cdd80cde67

  • SHA256

    e45d4f49ecc96f0f547227a02f637f7c9efffbb707a3d6e925ae1c59058be757

  • SHA512

    6b8236d73b76dfc3b496f1fe75511856a2fd4e248e58926aeb09ef43d5bca77d4656d2ef4068020cb94bc770de9d6813d4d56d82fcabf14754f611af3b96719f

  • SSDEEP

    12288:1Mr/y9062ZdylVnQ49DVFcAD8F/d9bq6UeNXHfISHmUi4tdwyM9yXmmvech:CylRD8hd9m6UeNXnmat6Gh

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1