Extracted

Extracted

• • Target

    26aa0cb4f40f9533360870030aaf572ddb58a0455d80ff5fe90baae8b4a53860

  • Size

    695KB

  • MD5

    05667a524837d06c6a4312f1390b986d

  • SHA1

    4416b2de3d1cde8f7ab00f12391171af38b966a9

  • SHA256

    26aa0cb4f40f9533360870030aaf572ddb58a0455d80ff5fe90baae8b4a53860

  • SHA512

    d20e0ce4c50aba6901710b0312d1eedd0fb63e9fcaa36e8d9b0fe784355b4c54d83fd13cde20b472c938ca464fa55dcf506dd314dd41903c8e02cd9552e7a385

  • SSDEEP

    12288:dMrTy90U2e/ESPlq6oDpYh8deDuml0m0R4Km+cKDlzSFqJbEAz0n0ObPAG0:Cyb2e/ESPPh8deDHlT0R4KXTxSUvA3bQ

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1