Extracted

Extracted

• • Target

    a7e90548f89f37c67e4d4dbf19bd08aef7b9ccd396c88a51af57f511dcf83ada

  • Size

    695KB

  • MD5

    4c19150d459ba981120a4311d31368b8

  • SHA1

    8e920063b955f027cc202cf30f5462d14476d834

  • SHA256

    a7e90548f89f37c67e4d4dbf19bd08aef7b9ccd396c88a51af57f511dcf83ada

  • SHA512

    b948c4099ba4e8c424e4940c692cbc33509b6529d563aa3cefddaa6626b2ede2ed99553f3941a2ff85d4e041e0966ae77b01db330570e1902fbf861cba829542

  • SSDEEP

    12288:fMrPy90Js6SyhrnGbfGTRbFxMylueSK394eyvPSKzF9vJ6ay3X8/hu4zz:Ay8s67aGdbFxMylueJt4eyyGF53y3X81

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1