Extracted

Extracted

• • Target

    852d7c0b51fbdb8a65e0be328656167fa1c2156ee46bf04714b2f7ec5610b2b9

  • Size

    696KB

  • MD5

    bb769f88159ee86bcb5529630637d357

  • SHA1

    44c5812f174fb136e4b1d4c419d9803a1169d5a7

  • SHA256

    852d7c0b51fbdb8a65e0be328656167fa1c2156ee46bf04714b2f7ec5610b2b9

  • SHA512

    f528f6236687e8f030c4f62deb4eb02f458641ecccae198412ca278c9a52dae237e49f0caf3aa595060e97b86af607d195751d0365bd7577e2535b5bb986e2e8

  • SSDEEP

    12288:/MrYy90jGml9TaSxjOk5lymwl2plsz3LUWd4VyDdnhk4ZzNFxJuSKQwSKPXvv:HyHmlNjSxl2p03oi5dnrpNvfzgv

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1