Extracted

Extracted

• • Target

    7dd04365c7e7d974e4b92919874f5219dcab5a739a781dd280edfa5e6bdc66ef

  • Size

    694KB

  • MD5

    696f88a6eb4f3c2a58d2758756452e59

  • SHA1

    984b1dfa9c127eb142fb3941eb4986ec760b9b27

  • SHA256

    7dd04365c7e7d974e4b92919874f5219dcab5a739a781dd280edfa5e6bdc66ef

  • SHA512

    96e627649ac90c4c0efab846cb41bb6a74072e0fc3ee327624238c63dae9119d8e60c1792dcc8b7869ee2fa1d68c79a567dac66740f3013e83a44b9ccb93b6b1

  • SSDEEP

    12288:xMrmgy907ORFMIWEJ9HRkm11XfsK0mIChttr0SRfvPSnWaM/J3R9S90QvxTG:SyxRFZLJ9HSu0K0m1ftYSZyWaEL9tIy

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1