Extracted

Extracted

• • Target

    6e95859a83ad147d1a9df5564dc76a25ca8567b8c54f642487a45dfa03253370

  • Size

    695KB

  • MD5

    183de2383bbbacdabd21e2ddfb9dd30e

  • SHA1

    efe3af25acc8fe376b80361009dd54e0273959ce

  • SHA256

    6e95859a83ad147d1a9df5564dc76a25ca8567b8c54f642487a45dfa03253370

  • SHA512

    a3ee66774d2bd8028b75ead1ea52f9e99a0acab3a96b859a627f076a54dd0496d7498e3a0d2e45e1b622c41aff9e64c7f93df34e04f53fc5e9df76c574f2f914

  • SSDEEP

    12288:BMr7y90UFm6pZk+xpuHN3NemaxgEkjoKFdehwiv1vPS/zN+uJpPKW6FA3n:ey7Zk+judNe1gEkjNFdep1ybNnPJ2Sn

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1