Extracted

Extracted

• • Target

    4629a84738e4d341d29fac4080eb87da926ffb5d078c9466e4c47c92e1839be6

  • Size

    700KB

  • MD5

    7dde5a9f7261047cac1598432342f80e

  • SHA1

    599e8c22e04d6d7d27753f39235575d8b9a99803

  • SHA256

    4629a84738e4d341d29fac4080eb87da926ffb5d078c9466e4c47c92e1839be6

  • SHA512

    c6e4e7ecef75663dba84217c7e3af3e76a9990bac46a9de2f3785f4a8f2d3b8949a8b38b19b14bec1916dd7c8b5d94049bee932b40741547619a6243ded79c19

  • SSDEEP

    12288:1Mrhy90hMWlL/ugP1AZimSKElVK9D5YcANlTFkX5xckUWW/eYVJvwN:AyzsLTtAjeDNlTIU7mYVlu

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1