Extracted

Extracted

• • Target

    97d552e97b64ab6a36b5649e255d0c30e91f907706325c3b60df35941453ab87

  • Size

    694KB

  • MD5

    24f86f7d35621aedbc7478480105e1a5

  • SHA1

    cd4dc55c2ca5ede34955da37514d76678204b803

  • SHA256

    97d552e97b64ab6a36b5649e255d0c30e91f907706325c3b60df35941453ab87

  • SHA512

    a807ca796106b4b8923fd5f54d2bd0cb9cfe5c80fe9475166a49964651e73362e2aacc21a176028c00a8dcfd429bb561c36f18314a9d6f6793ab22e79fdabd5f

  • SSDEEP

    12288:aMrVy90xvck6c7vJDtAs+G/YuPl2P/jebvPSYz3iMJbVf3maTb4/Z:fyNkBvJxr/Yel2XjebyA39Xf3nbE

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1