Extracted

Extracted

• • Target

    8ca707e2ec8f32173d670fdf6a731e265b02e5473c1558ea080327f0352e6f14

  • Size

    695KB

  • MD5

    838d7862475b81938125883abc85e4c1

  • SHA1

    693b608f80a642838d320b1e9d207ee0bfb4ef4a

  • SHA256

    8ca707e2ec8f32173d670fdf6a731e265b02e5473c1558ea080327f0352e6f14

  • SHA512

    ddb5044453b8732fa7d6f4e02d9703739ed02f5b8459d77fa25a5c3f27a648b8beacd35c39725e6bc74114e89b6287a0c8a13ee667112c21fd7ac1aebcb7c1f4

  • SSDEEP

    12288:3MrWy90mSrN2rm27uvml3PnAfwhLBkzhdvPSLr4PDJZmBsf9FDypWfj:tyKOnSnyH4L/9V1yY

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1