Extracted

Extracted

• • Target

    8ab8b80961bf8aa9ce3d9032867b0928cffa98a4792725ebf70cf6416906d52d

  • Size

    696KB

  • MD5

    bd345559cd0f9dc2dbc320b06c118d1e

  • SHA1

    84e39164c935a80207163ffe1c29f17fb4d41c74

  • SHA256

    8ab8b80961bf8aa9ce3d9032867b0928cffa98a4792725ebf70cf6416906d52d

  • SHA512

    ad8a857e220855006349a90548566b33b991f6238d68087932ad9d81d12c1530c21e1e5beca650db36f84e51a6538047d744959252b6f27732e21b892859c8e3

  • SSDEEP

    12288:dMrXy90GxseOhF4qbIq+JU0KOnOLUTf14trff6vxZ+xYzdAsJulhDIDlQ92:uyeCqsjJtdTfWtLf6vxkGddkn2C2

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1