Extracted

Extracted

• • Target

    0d962d1eae4cc61c67997ccff9895d8c64c0d1a16f6cd21a768c8e7b9269661c

  • Size

    695KB

  • MD5

    4fec67a0f98cb90ab51853978f778f62

  • SHA1

    b6b78c15a67814bc5b8040ce958466f270d328ac

  • SHA256

    0d962d1eae4cc61c67997ccff9895d8c64c0d1a16f6cd21a768c8e7b9269661c

  • SHA512

    6a1bef462db2ff0492f37782388a5da96fdcd7f3dfd6a2621ccdfd3c7a44c07f0727da28829a793c49c070b4d01edf623e757ebd74c1806c67fed5d514b7db2d

  • SSDEEP

    12288:gMrVy901WPrpwn79oOakAaq0kpv7/Nbt4PnhzPQs6kIMpvPpD:lym4Kn7jakr2VB4vhzPQsxJHZ

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1