Extracted

Extracted

• • Target

    44dbdb543f7af3feb8ff769602f7a3137af0e1b3fef2ee9d87aa6d890d5fee50

  • Size

    695KB

  • MD5

    b322ae4378334acc36396a4fbffa658c

  • SHA1

    b51e037707f69b961e78bb4a53431b62fa6fcb66

  • SHA256

    44dbdb543f7af3feb8ff769602f7a3137af0e1b3fef2ee9d87aa6d890d5fee50

  • SHA512

    d44071dc82e506c8888ede4254a3ec02fc207b9f8ae3d58c904f29f06ccdd6c277194899ae3076bc69d1f0e685a2f345ad90cc04d9c5c17a23e4a73e42813ac9

  • SSDEEP

    12288:CMrvy90vMEw7r8ULM89kC4Og43rWuuPle99p7tvPSwzIdyJ/7SqiMH:1ywFwH4Wg4SuelevBtyoIocs

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1