Extracted

Extracted

• • Target

    64aa9e753e4a2a0d36e4990008463c06540a617d554e812e2e9007991f04071b

  • Size

    696KB

  • MD5

    3d820357aa71dda3a8b9b5f88bcf7c53

  • SHA1

    8349875b68ea959ef7c9e3bb3a2a4fdb5b81e074

  • SHA256

    64aa9e753e4a2a0d36e4990008463c06540a617d554e812e2e9007991f04071b

  • SHA512

    5f42f5fd0bb57b4cb47f6e2a9ae340965dd1062b0997f6da2da324d866c0be85eda91d5394fb071778b2f388b33647a77a2f4c7356ec67d64197e1feafa18506

  • SSDEEP

    12288:vMr7y90lr+NbxmbilQjSwBFTy0jitrBKJs3Cz423Jspl5RorBJHFdwG8yz:AyQAcjPetpu4qGpWHFc4

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1