Extracted

Extracted

• • Target

    498495cd17341ed1e2e76d0d2376423351237895e05858748d162c67bdabee4e

  • Size

    694KB

  • MD5

    14168cfc16760c81af1316d379f70773

  • SHA1

    0b5540b74ac7b89e39a8e42983545aee2fa307ae

  • SHA256

    498495cd17341ed1e2e76d0d2376423351237895e05858748d162c67bdabee4e

  • SHA512

    1e32ff4555a3469f4242b1eb756a6ff65fd07c77c7bc6842e1a067a640c2c52446d7d308c73fc7f4149acb0a8637da933ee0787ca29fbba7266f2746faeafd8a

  • SSDEEP

    12288:7Mr1y9053mGtvsFG0rAa3F7bBY7bsG+iEfvPStzoYCJERPrlk2m7nR:ayW3mGREdF7qv3+nydoV2Rjm7R

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1