Extracted

Extracted

• • Target

    34873529b3b06a84d9ce5695bcce9fa3d75abac5ce4148f6e4264a55078fea9e

  • Size

    675KB

  • MD5

    0d97f051deea7bdd0be816105b0fa03d

  • SHA1

    4ab863673f93280b659ab6e9a0c1855c2b075ae5

  • SHA256

    34873529b3b06a84d9ce5695bcce9fa3d75abac5ce4148f6e4264a55078fea9e

  • SHA512

    3bf0f28ea6cd1626be6014c36c423a3ee6ee61c1d12c3be973cea09815116e0d4f2e7cbbed5a3575b7a9ea48a9b5313467fba4eb5d7ee2aa347e975cd7dcac75

  • SSDEEP

    12288:AMrIy90uc+GvDShzWJZp3OJ2CHjMayT0zh6nm4X/k6ZOrdwmEJUvi+HDS:4y8+GLScJZMjpFx+/kbrd39O

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1