Extracted

Extracted

• • Target

    54ad7efd071f4487e047b3ec6cc09a14ea1229f67597b8d5d8e46dc5fd4df5db

  • Size

    695KB

  • MD5

    c17e6ce48d095de4abfd550e7b3538d9

  • SHA1

    3e9a281c4f602155c99614ef412f6938b2f94a24

  • SHA256

    54ad7efd071f4487e047b3ec6cc09a14ea1229f67597b8d5d8e46dc5fd4df5db

  • SHA512

    fd498f2953f2dddde6af6c37123470df39034481f2da03e26da3bb23482d2959fa3bfd4ba7be7bf99edfe147f52639b3c0a142668c29191a692c78e45156decc

  • SSDEEP

    12288:qMrTy90U+ZjujSHq0Z5VAVqK0+Oial0KSutUhqj9aXnhqRQs6vIMK6I:JyEHqurob1aGK24jghqRQsuNI

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1