Extracted

Extracted

• • Target

    d31a20d47acb6f78287e40f249f833dfc1ac7bfec8a16732d05088f17119d12f

  • Size

    695KB

  • MD5

    f826ae85c3f2443448942633e7879db7

  • SHA1

    b364563cec1239db008ed414c31f590961bb4361

  • SHA256

    d31a20d47acb6f78287e40f249f833dfc1ac7bfec8a16732d05088f17119d12f

  • SHA512

    f961871b20628d1b6c2f6128dcbc94253146d99ba80dc1706aa2c779c51648bee83f790c1b913429723c400b250e54647ba613dee060e4afbdc04b8f612b38ba

  • SSDEEP

    12288:CMrTy90JuZdfNMVTmKf0A8qIxuIszeLzOS0nh/4Qs69IQ0iVvB+A:RyvnfNMRMNFh/ZKh/4QssIsgA

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1