Extracted

Extracted

• • Target

    993c3acf5ee675bc5242f9d91f6774b6be155f8bcd7f9ad06d1f0cb90bcf3f7c

  • Size

    699KB

  • MD5

    df75224ce8c94d6563b58dec1cacef86

  • SHA1

    724a711058eaa0cc113598d0ea1ddc9b4fc9b696

  • SHA256

    993c3acf5ee675bc5242f9d91f6774b6be155f8bcd7f9ad06d1f0cb90bcf3f7c

  • SHA512

    94123418742d09f516bfd4d698ab195585495d7f3ef8906026343badbe2e6f4594e35a0c96c303ea28c6ff661009d3c5f45f8fd633a0ae6c470988e35fc47d22

  • SSDEEP

    12288:5MrYy90llsV3oW/LyP21LmdIv3G5jOQMb2iG8vZrM8NwPIzLL9rFtATrO7F:JyZ3/LU29j3G5jOXb2iGyrM8NAIfL9Zd

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1