Extracted

Extracted

• • Target

    a6f4a74274c39f9e3f74fa14e123f08c1ec5c7bd1738a0d1fa393305650c1757

  • Size

    700KB

  • MD5

    a7ba92ec0a72c1317206cd89927ae844

  • SHA1

    e9db3989bd267ea133ea50da646ff015b4a23b59

  • SHA256

    a6f4a74274c39f9e3f74fa14e123f08c1ec5c7bd1738a0d1fa393305650c1757

  • SHA512

    3b329fa1a70328d1fc0823128c4e1d5dfc851bcc1279f53734b3ebb08ffc7b50641bbc352bf23291f1fec9e994b5f1252bb18e3073580edc8c18b98bdb7be641

  • SSDEEP

    12288:sMrdy908bMS45rgWVtHKez99D5qcAuIIW1gAufC14R9vGXV3s:py34HRz6uI0AufC1E9Ol3s

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1