Extracted

Extracted

• • Target

    974238473faa9bfa3fab046790d16c64ccdc7121c403b62a3a42cf920936e3dd

  • Size

    705KB

  • MD5

    428635f0f2ca0902c95be6f34300a15c

  • SHA1

    055bdfd22978beb4522a7507bdb84a3331defe72

  • SHA256

    974238473faa9bfa3fab046790d16c64ccdc7121c403b62a3a42cf920936e3dd

  • SHA512

    36ec32958dec7efa557d83b61229496cd12b9e3926c298fcb7768cfe067a7ea2a38e3202c393faa1b06f38a962cc33b1701f7ab2c24560574ac55bf364137122

  • SSDEEP

    12288:eO6S7n/ZoP1za+5aiJibYK06ewHcRY5X4dnMzJfiXplfXJ/TD+VIx1LHK3uv:eOPxqza+hibYSw/YfiXpl1TS+LHWW

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1