Extracted

Extracted

• • Target

    3d8ada78f53157900720466b204b37e8a5693eb0e4e0ca41b872383eaf39d7c8

  • Size

    696KB

  • MD5

    27982d80d5501a3c29a46db3eaccbcf2

  • SHA1

    33f7383aa14d73fd01bb248c0e211464b342b068

  • SHA256

    3d8ada78f53157900720466b204b37e8a5693eb0e4e0ca41b872383eaf39d7c8

  • SHA512

    871c8ebcdd1d1d42edf8797dde02a18566ccc93acfaf9dd885b339a1027b0a0683fdf4d87093d6aacec197c7f9d570f02f085c4de6c67a934bf2a737bb62c30d

  • SSDEEP

    12288:dMrXy90qUgC3Yt42SFBDAm811yfPnrMv7OdyfIskXz9fYJ3FKQJDRkab:qyCgz/SdfPnov7OdyQsC9wTlRke

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1