Extracted

Extracted

• • Target

    35ec3b1a14473120f43dae5d721ceef9a3d3d933b735068b557fc8c1df944ac3

  • Size

    695KB

  • MD5

    dd5135979d4c43ab8631e4d356baabd6

  • SHA1

    0d1898e4073d383fbfb9126283415b7d7e5f0a98

  • SHA256

    35ec3b1a14473120f43dae5d721ceef9a3d3d933b735068b557fc8c1df944ac3

  • SHA512

    c79b69cfc17a57f66430e97dec90ade486d97d7e0e93c424d65eee8f41e31f4c5877ee456d68a9a533d09619d6b71c6bd4058fb9fd8a76460e23bbd0a7515280

  • SSDEEP

    12288:kMrey90r8txlEyUo+/+agWcPinSRJGxvuBxzhQkqnh5IVTojJ8jbB:Cy40lEiq1gWcqSRJGcxIh5Koj2l

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1