Extracted

Extracted

• • Target

    0221e936a07380560d2906539e72114e767b381cb99c37af247c7d6e05b7f66b

  • Size

    695KB

  • MD5

    2c9ee479346717e4db2ed8baa58e5515

  • SHA1

    dcee4e0de297ac4247a5c3f6997057c467010d63

  • SHA256

    0221e936a07380560d2906539e72114e767b381cb99c37af247c7d6e05b7f66b

  • SHA512

    fd0370b0df8d9ff3b8446555c16794f55e37993f23af6e64ec15bb5d111275fe7685384a5ffac4a6c0a5e6d1d427bb96d23e797e4569b1dbd34740bc0c21d2cf

  • SSDEEP

    12288:NMrvy90z3yFko7VAXIA9qRPrEHuOkZoEnhKNmIHPCRwNg8:iyA3yka9UoPgx6hKwIHPYM

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1