Extracted

Extracted

• • Target

    c922a9a3105c027e150a594d36d773554196c78ec6c049d69b418b812b97611b

  • Size

    695KB

  • MD5

    c6efff595af26320b452eeec9cf1a327

  • SHA1

    846b382063eadfc221492f16542890d7f0c54300

  • SHA256

    c922a9a3105c027e150a594d36d773554196c78ec6c049d69b418b812b97611b

  • SHA512

    c8c3c5f545b8528cf8d6f6d6ecac480e63d7e48e33b9e9ea2f46c65aefdf92c57188c074098dc356d02bbc52c29bde22d981688d3c589e27b9945fb2f3beb173

  • SSDEEP

    12288:pMrgy90NQ13jVDhR3fnJSTPs6JxQvHPnqjxitrSQ9xvHfsGzbhzJ3wQHmktN8KId:RyhDXJSThJxmHPht//kCbh5HmktyKId

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1