Extracted

Extracted

• • Target

    ac45a803d8b22c9be9ff25c75e940e9e0b098793614612956bfe854b560fd750

  • Size

    700KB

  • MD5

    e7050ababab3205b6407d278e309c1ea

  • SHA1

    513b6717cee4d695c9938e7077dd9e672d03401f

  • SHA256

    ac45a803d8b22c9be9ff25c75e940e9e0b098793614612956bfe854b560fd750

  • SHA512

    897d54aa74c9d1f612d8337fd5da077dbabcaa90583e25f275b2d461ceef20a486577c6dab568457521846a9815c7ea0e0b6184b9203c03ebcfdedc44521320e

  • SSDEEP

    12288:UMrUy90FSkZAjyIMoPISg9DAqcASNBqc5tTQp+D4xu60GO1/n3:wyHj5MS4SqS5ZD4Qxv

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1