Extracted

Extracted

• • Target

    f68ad49780257599c5a663d70ad14b8b8814465b681fd14fce247ebe1e40bef7

  • Size

    695KB

  • MD5

    a7113779acd35c2fd2c69082c89482e5

  • SHA1

    583b0c792780f08eccc509d0569c6c098b6c1036

  • SHA256

    f68ad49780257599c5a663d70ad14b8b8814465b681fd14fce247ebe1e40bef7

  • SHA512

    15630253ac62eeb1097bcaf4cac8a3ecc54aff2678621c32dd5852b5370e7ace5d3f504229e0f7496b6eed1494b69bb41d8f3ef00cd97037307c0d704967df8e

  • SSDEEP

    12288:kMrFy90VTNiV3jSFvJZkYBe6f7fsr5wMylUk/KKUWMTrvPSlzQHWJkwQTmkjL:xy5VTXYBvdMylUk/BUWMTrylQ2sTmkjL

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1