Extracted

Extracted

• • Target

    62907b6b027da98ef1e736777d44363752286ebbb14dc096d8641fc41e7fb9f3

  • Size

    695KB

  • MD5

    888093fb536e28aff1207ba2ee3470bd

  • SHA1

    205142f16b857f4eb7c2216881877fed7af7860e

  • SHA256

    62907b6b027da98ef1e736777d44363752286ebbb14dc096d8641fc41e7fb9f3

  • SHA512

    673e3ba734fb2f56628ff55429b7b988bdd3e7526200286eeda1e46a4b55212f2124fd8b8eb2d9008ae1be2ad9305ead7cedd434cefd0519247301d60df98591

  • SSDEEP

    12288:iMrHy90jkdiOpFQnN3EHECOyj8XAEgq8uan0pJYenhVvQs6uIcooHNz:tyNdxsEbOdwEgEpSshVvQsDv5

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1