Extracted

Extracted

• • Target

    ede319c36ca8a447f51fe51b1e6c049398ed2a5abc37baa636be2f4064339465

  • Size

    696KB

  • MD5

    c9922b38dddf2d3815af1b655d5cb24e

  • SHA1

    47d9e67204afa0f75da59de6d515c75e8d46c680

  • SHA256

    ede319c36ca8a447f51fe51b1e6c049398ed2a5abc37baa636be2f4064339465

  • SHA512

    9bb801848938c24324fd5962b3b1153faaf54ce94fee138d89d65af7f5c492b7b3cc68e7590e5426cb2e83944eae9a7952feccf84df116d5d0d77916d54d6a64

  • SSDEEP

    12288:VMrdy90yCM+7cuFcH7gVSa/hJkjaEEHL2Vdl/JzvHRJitEnqqrd6:Qy+I+nVjXEqId9Zvx2EX6

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1