Extracted

Extracted

• • Target

    98c3c19265756fe1ca6890f7e63e54461c8798e7cacc41a6246735a371450cfc

  • Size

    705KB

  • MD5

    9c20737ed2dc1b72134d7a7aaff73405

  • SHA1

    8a4c51de8959096dd366a2fa22027e8547f0d305

  • SHA256

    98c3c19265756fe1ca6890f7e63e54461c8798e7cacc41a6246735a371450cfc

  • SHA512

    dcbf113ba6ba74fa3f90f2c3d636fe7e354fcb4c4dbf78bb1e3df2c09af392f59a490725118b657ae28ab1a583409bcdcc2a2ba5349cc4e8ee1d746ec8e759aa

  • SSDEEP

    12288:De42StnJqYU2E8wGHAoYuYvX2M8tA2NLLMcWKdAo:De4tMY9EMHAS5lkKdAo

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1