Extracted

Extracted

• • Target

    cfa5aaf9cd6b49f3de97bd3f5a97a21d33b1fd0c89f06a3c63c62112d626de6f

  • Size

    696KB

  • MD5

    e288231352766ba55eb8e2517a0a773b

  • SHA1

    6f0346fdd7cb930992b2531d7f33d7de54fc5813

  • SHA256

    cfa5aaf9cd6b49f3de97bd3f5a97a21d33b1fd0c89f06a3c63c62112d626de6f

  • SHA512

    7dffa0d7756e86bc4a8c6bb106306df2c29d3702f7a0de99794bec18fefdc22451993d5d80d1e3336cc1eb9bc431eb94a79d944608e1e98c83fb7dc0071d7428

  • SSDEEP

    12288:AMrry90VOSFgR63R9Ei+pGTVXhXuuleu/vtKLz3sWtnhATQs6cIjn0NUo:7yXW/Ei+peXhXuulR/vtyT1hATQshi0t

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1