Extracted

Extracted

• • Target

    79b5713ebf3914402fcfc60da319bfa42392faa5b1d5b6b37bd9ed55eeb7fb1c

  • Size

    700KB

  • MD5

    021b171a80a22c805479a07091ef4ef4

  • SHA1

    aee7ac33575905a10e05855f4759b8086c92a5b4

  • SHA256

    79b5713ebf3914402fcfc60da319bfa42392faa5b1d5b6b37bd9ed55eeb7fb1c

  • SHA512

    e482f579984cbc589639167ffc481f9ac7f7c53d43a3b471cc05f123db343c91e0afcc150376006ed9c17ef1d38329bf527aa3d887e91a130cbcf4285ac27a2e

  • SSDEEP

    12288:6Mrzy90Uzi1M3Aj4U1IhlMyQO25TBr1i3Fx1z3xYiKiE9NwPYNL/3M7YgTFTRDVt:ByvzPhqO25Td1if1rxFS9NAYl/M7YgBN

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1