Extracted

Extracted

• • Target

    33ff79cc809d26da6c10e69e041e8ae0ba5e6a87604d90e8fec3a8e362b6cd1d

  • Size

    695KB

  • MD5

    cfae29acf528ce5a2c4d9d5c4038f4ce

  • SHA1

    1471f59e3f514ec22c0da313424fe59ddad65433

  • SHA256

    33ff79cc809d26da6c10e69e041e8ae0ba5e6a87604d90e8fec3a8e362b6cd1d

  • SHA512

    badefc9b950d53011386b3a3c54e746fbd0584b43a44e6ecf750c24a17f6509d9150ddb57f9d356c3f40262ca47813e868c043d6be29746e04ad521aa73b6709

  • SSDEEP

    12288:NMrby90A9APk5Ilj0rXlpAEqBroGNuLVFYzxd/xnhAx9MuCJgdZ4:KyHKAr/1+kTVFYzxFhhA7beQZ4

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1