Extracted

Extracted

• • Target

    7b73677a40d5ec0a2af9f23fef8356ea27683eee3d116da92d53ad70e9cb2bb5

  • Size

    695KB

  • MD5

    0bdb50db27e3a582914deeffdb0db3d5

  • SHA1

    45489b92bf83cb236546cb59a7c6df00e33520ef

  • SHA256

    7b73677a40d5ec0a2af9f23fef8356ea27683eee3d116da92d53ad70e9cb2bb5

  • SHA512

    1f1267ce21bd8fe0d371a5b5045d419d7fd2539c2b985171bd2558762ce0ccc4f337c18619258a606352f3f8a25830a166bf3a63b54c44b0e76211dcd5c1449e

  • SSDEEP

    12288:vMrNy90oh3SvVPr4Fz79i6jjLPfQUMylWgz4W1IjzM7zskrJ186EZWPrr:CyxhC1r4d48zHMylW44W1WzAs0BEITr

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1