Extracted

Extracted

• • Target

    a88adb3257f7f0629e3670a4d0c61a8ad8ea970bfb81f1ecba2d1da6c5fd31eb

  • Size

    690KB

  • MD5

    cf1873bbb5ea0b433fce3bad774f275f

  • SHA1

    67ead4065d45837f77d5402ef2197d5007078771

  • SHA256

    a88adb3257f7f0629e3670a4d0c61a8ad8ea970bfb81f1ecba2d1da6c5fd31eb

  • SHA512

    9df3784b767bd56cdc2f335c179653bb862760b731b4b24ea30cc79c696f9211b0defa942fca642d40553b1f7b19d7f5861aa91e65890d0b3470565d9909381f

  • SSDEEP

    12288:gMr7y901NeBydm/q1Az7qFoyY65hLuzq1F7nnd6e+5vRFqffigsKJ4Hd+5sGEdBB:LyWN+yFE+bXfa2jndIjqfagxit1

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1