Extracted

Extracted

• • Target

    4ee2a2676c57d925c359be2d4af3b37be85a3f1733a104aaf55fb93650ccb96b

  • Size

    695KB

  • MD5

    39a5d719823b7a9091496ee134b89d79

  • SHA1

    c263f229c69bb5c94f9f8b5adf834bd4e06187d1

  • SHA256

    4ee2a2676c57d925c359be2d4af3b37be85a3f1733a104aaf55fb93650ccb96b

  • SHA512

    ce927fd35563b489a78481fab66a38dd34add34862c585910e65b5f9670b4d95b8e82158ca75b9d1ce13e834c53ab40fe8062294451f0968b175a67c195efa39

  • SSDEEP

    12288:HMr9y90ajuzPgl6b9Dt3NWNuPly1O4H4kQ5zGAbJ57Wt9UeJ:aytizPgl6b9xANely1Ov/GU89PJ

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1