Extracted

Extracted

• • Target

    c97620b6a117017101c913bc0eafec128757867671edb6df68dc122f443cf449

  • Size

    695KB

  • MD5

    2685dd13218d5d1d046f5f9622812a37

  • SHA1

    b5da7487af60ce5847cac64f14e2c901a0531fde

  • SHA256

    c97620b6a117017101c913bc0eafec128757867671edb6df68dc122f443cf449

  • SHA512

    e77051d0f2500827583dbf07f74fc734242ac44043e23c0a0e0ebe03ebc8045c0f9b10aee2b842e471d0629588e7469c87c12c04811c8793ebd4e788e4fa9584

  • SSDEEP

    12288:vMrzy90QPaiQikEGZgmwOaDtmZWNuPlyfYgFRM58Fkezo6bJBmjX0kFw:0yUi/GZgqaxvNelyfYEM6po4qjdu

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1