Extracted

Extracted

• • Target

    62b15797b62e0ad2466719c1d52a7c418b9348bd01ffce79c7836d4e22fa4711

  • Size

    700KB

  • MD5

    d901336f71f1b1dd47cb93737e6505a0

  • SHA1

    503fd7043794c77cc44a87165245cf19bb06f6af

  • SHA256

    62b15797b62e0ad2466719c1d52a7c418b9348bd01ffce79c7836d4e22fa4711

  • SHA512

    12319c8fa74c70b6275bc479eb9ad817ac8347a398a5460c2b3c67d2ac3550626b6d7e75e7da6fcf749c701b8640f7eeaf12e279d95f93c8d45085077f628619

  • SSDEEP

    12288:iMr6y90jdp5B/KM21Gqq1Ay9D5ScAg4NkNPq1DgTQLhe4mFywPkbjqz:wyedpf1f1og4QqkOGpkbOz

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1