Extracted

Extracted

• • Target

    aa7bca2d2173308a37ffcf2ffb75b9ac6f2711cc413fb7398efe0de5645ea341

  • Size

    694KB

  • MD5

    578f1ae62a08a1c3fabfe7a400a52b0b

  • SHA1

    6da7d41d45e86cd9a3c59b9deed76c7fb81d7e8d

  • SHA256

    aa7bca2d2173308a37ffcf2ffb75b9ac6f2711cc413fb7398efe0de5645ea341

  • SHA512

    ac2616d27064193723b306aa44c8c2a348579e2e3d4e937fc2b52dd5060a015c3429ea92de43b28d79245faa5fc8a9bd9fa7cd89edbdbce303ddc9dcecb2f8fa

  • SSDEEP

    12288:pMr2y90ITdAPjyi9p0WM7dSDthj6kuPley00D8QsCvPSlzkfaJJ5T65EICs1j:TyJiyIp0ndSxYkeleJ08QRylkCJT651j

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1