Extracted

Extracted

• • Target

    274e2e823a31a4dd443626b329ebc33e1320583e4443a046625729955eaf415e

  • Size

    700KB

  • MD5

    9fa21a8ab0f2008b2fb9c4d5792b02f0

  • SHA1

    df14be01d38356da48dd79acc2edd6dd8902ec0b

  • SHA256

    274e2e823a31a4dd443626b329ebc33e1320583e4443a046625729955eaf415e

  • SHA512

    e947838016310e3690bbe54e66e3eb165ec21e8087de8756984fc90ab06f8e7544f57af98af4cd79bf071eea1a3671e6b11a8f98e895dab2790e125f5e9cbfb9

  • SSDEEP

    12288:0Mr6y90gSCRMNRtD9D/gcAFDCzN+qOdH6DkkX9bshrwd:uyBR0R+FPq7jJ

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1