Extracted

Extracted

• • Target

    c3bc09ca7f306dda59167240348380e83e1ffec57a4dca10a4c110bd552672d0

  • Size

    695KB

  • MD5

    307f8b9bd6937074b57130acc0d3b38d

  • SHA1

    64f756f41857025a0813ad878d7a382e520335f6

  • SHA256

    c3bc09ca7f306dda59167240348380e83e1ffec57a4dca10a4c110bd552672d0

  • SHA512

    a5fe6972c8e21d8111fb0a8ec1cbd51b0cd01bbd49d995d38b8efcbccae14ea9bea7bf95b7ce073a850d881852e5265335e16e55bfc289eb922d55bc0831886e

  • SSDEEP

    12288:RMroy90uvhFW+4RogBuwLsRzi8O+avPS0zvxfJ1kX/NINoPr:VyXT6RNkwLwzi8OPycvt4VINoD

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1