Extracted

Extracted

• • Target

    4700331e8a9cc0b72e5f247fadc958b5d05db10ccc69e1942bf1889a1459cdfd

  • Size

    700KB

  • MD5

    89af4f67653f2867d4f1bcf216f2a0f4

  • SHA1

    ea4940b6ad10a85fe6159b8d20917a22c5a89a6b

  • SHA256

    4700331e8a9cc0b72e5f247fadc958b5d05db10ccc69e1942bf1889a1459cdfd

  • SHA512

    3ddadc3ea634dbb463e1e79632aea5af1051aac249765a83189aa625a994451e0fca4d57c58be519ea15f9d2dc2fda60530bd88cc74201af6a73a21661c0f13e

  • SSDEEP

    12288:nMrJy90rEqaG+FfFmmI09kc+1VpFQHm/5ovNMj5X4rWs5FNj7xvg1IvM4DKZG7:OyEnV+xAnnBZ5XoFNHxY1IvM4DKZs

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1