Extracted

Extracted

• • Target

    6539432ba22afc332430d3e78bf785f5232360fc50f45e3e0f61b93f96da5688

  • Size

    705KB

  • MD5

    0dabed690dad22cffe6902fc451110e6

  • SHA1

    74f47f19095174c377723dfb0868efc7048ab961

  • SHA256

    6539432ba22afc332430d3e78bf785f5232360fc50f45e3e0f61b93f96da5688

  • SHA512

    cb63d00a1eb41b9a0f0811c1c13c2d0205e84bc09cad1022ee3b215df201fcc84a4f6f46c024ba9a65ea368dbb3ab9ffb968583f8b2138b86cd0bccab79c46fa

  • SSDEEP

    12288:je42StnJqYU2E8wGHAoYuYvX2M8tA2NLLMcWKdAo:je4tMY9EMHAS5lkKdAo

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1