Extracted

Extracted

• • Target

    e500189557bab4e9da6d58ee6451c0f25cc01933cefb5c5f1b4b134df3ca3501

  • Size

    695KB

  • MD5

    ba5d769137c45d1efbbdc9cd864f0baa

  • SHA1

    6e55ef58edc59f58ff4120e16e85c820e62df029

  • SHA256

    e500189557bab4e9da6d58ee6451c0f25cc01933cefb5c5f1b4b134df3ca3501

  • SHA512

    25848defa13a9ba7c9f8bfca7b42f0e1b80258f888784f36e856026c110f2882b461302de445f9830c161017f2a374abe174cb7c7152a34f23b7bf225b647c25

  • SSDEEP

    12288:uMrjy90nuOeffp5JE0bQsQZ8hcxl/lkAVDTOUKzyfvPSozKMlJLuA6vIwaxN:1yEuOe353hgl/RcUKz+yQK8N61EN

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1