Extracted

Extracted

• • Target

    c1ac6f91df74dfa55bde7b479d4e6e357b55a3f7325da8dd6985d71c2e8a035a

  • Size

    695KB

  • MD5

    f2ece4cf1c852c3d1b6005311300e127

  • SHA1

    4c0ab7cc93ae19e960863adc23c78a6118ffaaaa

  • SHA256

    c1ac6f91df74dfa55bde7b479d4e6e357b55a3f7325da8dd6985d71c2e8a035a

  • SHA512

    fdc41b0e0d2f6702b35da85cd0a9df48c0deef81c7657c2ecf3530e5b1abdcf6f9f7eac56d377803b890e78efb4d81bab4a44fd49b01761d7c895c8b8126a6a7

  • SSDEEP

    12288:QMr/y9032S5WKpYRB8pIHI8DgwtDSojKL4gHzmBnhBC8GibLG2E:/ym2SW0skIHbTGojKLNUhBLGeLG/

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1