Extracted

Extracted

• • Target

    81108f24fb5764f8fd0f7b6c71d0973ac890bec038e886a044fa89b12955a69b

  • Size

    700KB

  • MD5

    e595357fb86bf809cc193820884d2a0d

  • SHA1

    d17960b0df1c7b963786610f18f42cb53cbc2442

  • SHA256

    81108f24fb5764f8fd0f7b6c71d0973ac890bec038e886a044fa89b12955a69b

  • SHA512

    02d9734426b5807418ba7dfbd78bc4cf39372419853d56fcd272189ea3f65f4ecd50eaf937dd44690bac1d3251ca39f97f48d399ebdf81eb570458e8ef6c5699

  • SSDEEP

    12288:hMrVy90oc0WrgH/kUqIdDbnE6jdMkUTrpkD2uNdrMRNwPfFLKbn+COF8UZvyR:kyZO0k6pEcakUXpkDv7rMRNAfNKT/OSp

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1