Extracted

Extracted

• • Target

    75f0077f795516ce0d8be655dee368cab2159a2baefa2f7509ef9c347e5f5a85

  • Size

    694KB

  • MD5

    5913a0b837ea391257b56edf14c756c1

  • SHA1

    4c277880ddf480f750c2d81fbe2a1623273cdb2a

  • SHA256

    75f0077f795516ce0d8be655dee368cab2159a2baefa2f7509ef9c347e5f5a85

  • SHA512

    b4529df29213a04f6f95495c072e296600e86e90f44495be1adfe3b99b8747f6079aec107a8bc89348ec73f6e5d2e2bb87509c63baf091412af99192631e3e65

  • SSDEEP

    12288:TMrjy90DIUNlF3JeMjOAsqqzDrRjxvEkpPiDjnhUtQs66I/DrEM49BWEn:cyUIUNP3Ni9tXRjmkpPivhUtQszQCWEn

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1