Extracted

Extracted

• • Target

    9a2f1a9eaadd70eb1052d55aaaaa9993c66c4f32c52a27cd2e5ea14e4f03c79f

  • Size

    696KB

  • MD5

    d63f0a998c714b199c06b6661c3a4037

  • SHA1

    97b48f1fad307ab8ddf80a8343a79d9fb960c375

  • SHA256

    9a2f1a9eaadd70eb1052d55aaaaa9993c66c4f32c52a27cd2e5ea14e4f03c79f

  • SHA512

    9a609d3e1152787b97953cdd55e3d2b5ed8a309a3b9d36f3dc5621cd3baa0e64eb32421e893d432f853daea061dbc025284e0efb3243450f610de9912f61058c

  • SSDEEP

    12288:IMrdy90rv4JLHYnLruoLu+eVQM3mXMl7S7lLvIZeQbrsaMf1dzL0EJkSKQXKjyW0:1ySvvruooVN3mcl7S7lLvIcCGfLx9PyE

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1