Extracted

Extracted

• • Target

    0b00a539d6a36165d510e2f22ecaa1b8a41839582aef95ee6477554bc7607bfa

  • Size

    695KB

  • MD5

    8874932b53c58e1ef1c2d7080987eddb

  • SHA1

    506b23d04e5ee75d16ae97b63cbfe194c8c73ac8

  • SHA256

    0b00a539d6a36165d510e2f22ecaa1b8a41839582aef95ee6477554bc7607bfa

  • SHA512

    43535c8e0dabaa47870ff51b7241d504eebeb242b6a33e10d2cc4f84534226c186ace856e343643ed74649c4a57315a50b88755b5ef85fcfa79ab0f1fde3d6df

  • SSDEEP

    12288:FMrFy90kCzHPzZYDtiHnufuPlyzEQ8aUkK5zwARJ5TWtYe6VQ:IyQ3ZYxanufelyzEQ8Z/woUx

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1