Extracted

Extracted

• • Target

    0e7b98053bbb55f350854a13e1c24297458e3f32d31efd4a30210c980bf2acec

  • Size

    694KB

  • MD5

    6af8844480f4b43cec6afb0af2e9a237

  • SHA1

    360e269437066daadd1a1e14b84f6aaec58da342

  • SHA256

    0e7b98053bbb55f350854a13e1c24297458e3f32d31efd4a30210c980bf2acec

  • SHA512

    b7e358293fa9329e44d324cff11704df633c3890bcbd810f5d9b479a73b9b9548b1551e5c83348492cd2309b876ebf77d3a34a7a62453c9e630c1360a885fba6

  • SSDEEP

    12288:9Mr+Oy904hidir2ifOTRTSoWvvPSQzKrLJa6Xownpd2S3o:8yDuifmgyIKnAWnpdG

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1