Extracted

Extracted

• • Target

    43dddd4574c193138f4be438f088e10986aef481206f39f8ee46f38f95b1a265

  • Size

    695KB

  • MD5

    b4bf4af149607f98138166d7aab2b806

  • SHA1

    c1a5e20903e664accff8e68e53aebe7f8d449ffe

  • SHA256

    43dddd4574c193138f4be438f088e10986aef481206f39f8ee46f38f95b1a265

  • SHA512

    437c9fdd79a663a7b7a8f3a8cf3b54a8a175960c24c140f39625b057ad372cdff01e21a9f75b5a2aa1f4673a2da2d42325073b5b9d51888bfeb30bda3a82d26f

  • SSDEEP

    12288:RMrPy90BSVuHZFZy2PrAnwyOinGlQJGFOvPSpzbjoJiEAz97MRt:CyiXrymr5ioQogy5bMyaRt

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1