Extracted

Extracted

• • Target

    e398393c5aed79cb2f2f8194977a59ecf3f12fa6e2f8af04d4cbe68a984df918

  • Size

    695KB

  • MD5

    2553ff8e29160fbe8a13dd3184b04c6c

  • SHA1

    3886377a96ba28f5ee17e6c04cad2246449eecb7

  • SHA256

    e398393c5aed79cb2f2f8194977a59ecf3f12fa6e2f8af04d4cbe68a984df918

  • SHA512

    f042c539131159612c4c69d490d6d977b660254ccfcb191b3f443d37b8e3b96fcd31d4ddcec834b5e4fdf17fa162ad494da1fc13e0d532df4177d3c098f38c87

  • SSDEEP

    12288:NMrny90n/jZSI3gr23J2ARqaVFuml3ldGxnh6ZQs6WIcPswT+BLA6V:OyWjZ8rikM5Vv3lQhh6ZQsPAwTElV

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1