Extracted

Extracted

• • Target

    555a2280e828351a8bc6658eb596cba82fca7b384a4399cc0db438eea3926a53

  • Size

    695KB

  • MD5

    3d5612e4356e411b1e90db0a6652b59f

  • SHA1

    4db7a71d3559e9bea144beacbf30ce4ce87bface

  • SHA256

    555a2280e828351a8bc6658eb596cba82fca7b384a4399cc0db438eea3926a53

  • SHA512

    e9c4206a460dccd8c09b48073ab4f66521aba83bc956644cac63230704155ffbe479d415b6a532cc298d0df4fdfabeb1150deeb443c0b59e5c72199cc08355ef

  • SSDEEP

    12288:0Mriy90u2tV7CQ4AFVtEhLjkC8ezQvPSuHLtaJKnKlaoxSNEg1:2y8d58QyoLoAoxSNEg1

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1