Extracted

Extracted

• • Target

    0dfbc5e296cc3492512e65c72fe5a2736c9609f1d0afe87d7708d7f1d9d3181b

  • Size

    695KB

  • MD5

    2b78542cb66393689ba5f5b22139691a

  • SHA1

    d06cc1c59cfb76c64202f13eb625555d672baea2

  • SHA256

    0dfbc5e296cc3492512e65c72fe5a2736c9609f1d0afe87d7708d7f1d9d3181b

  • SHA512

    2ae044a2d69da9861f223d6fa7257e324a87e6982b6ae63c5d809459117849a0bd18555a2a3f9f3c2502a3e671ce3b2b250769944d58badb8da261a00c7ff214

  • SSDEEP

    12288:4MrXy90lFjiUoE0aVZU6Gwmm9Xlacps6DzteiJagpO2vWq:vyW1iUo2VDXiWtHpI2r

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1