Extracted

Extracted

• • Target

    a2768446ceae346237df402d45ee9982b1d69dc85a67982c9b7dd0ebdf054bd6

  • Size

    696KB

  • MD5

    cfe3d4d2b964d73c9db203588342a916

  • SHA1

    56e688a6b3e9131dcc2ef3bc18b3396cdf226d89

  • SHA256

    a2768446ceae346237df402d45ee9982b1d69dc85a67982c9b7dd0ebdf054bd6

  • SHA512

    ffd12cbee11cbfd478869e1af9ccfdf0f40f2aba45f5b6e45a5d8e0ecb3bce5b4911f2979b8c63e813122463df6c9712a66f925e6bf651b572c7d5004acf62f5

  • SSDEEP

    12288:LMrby908Ktx7h5YR5w8wSWf0oaBJG44ks++gY1D2DZJSC2J5ZW0+Vc:4ySLh5ORWsoaLgZ1D2leZWxVc

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1