Extracted

Extracted

• • Target

    fdc98cd521c4051b32685d81dd2d579b2c99b501bf2476ca9b23fea5f517a85a

  • Size

    690KB

  • MD5

    a3cd2fabe8fddd09d0f16b379590b493

  • SHA1

    ca65c759ba8d490a956910185e09d1c3f8638731

  • SHA256

    fdc98cd521c4051b32685d81dd2d579b2c99b501bf2476ca9b23fea5f517a85a

  • SHA512

    5ff316c3e8744432c7eb7ac6cdacfd141ad3ff4a44029ebb0b7a9e69d67a2bc98ebb41b509f84b8a67f570d6ff5dce82c3b8f3ae1dec664bd4fa1ad284b43869

  • SSDEEP

    12288:/MrMy90l0HFAFyLyy65hLud8cNhvwB/tvxvJF+dfigzMhntoNUS:Hyb6w2hfadrhy/BxL+dagz2S

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1