Extracted

Extracted

• • Target

    a9a98a4f5f158736b9b0944c2d9a4b23b41f09e2f3abca85beb8651fd05c2730

  • Size

    689KB

  • MD5

    19d777330aae9f2f70e83668e130f460

  • SHA1

    3519b6d1dea28a3543c42f09a06080c0469d1810

  • SHA256

    a9a98a4f5f158736b9b0944c2d9a4b23b41f09e2f3abca85beb8651fd05c2730

  • SHA512

    887c97dc33f5d1efa4a19396d8428dbd743f72e19415f10624cc59d9edc8068e1a4cfb1485f0c74c158ca8048e20d3837f721ed3294a4263f0768d16604b6e72

  • SSDEEP

    12288:cMr/y90ehwqG8pPIx8rRdxoaB5mgHrlmJfvxF6WfigjG6Plekyv:zyVhwqGS4aB5pmJfT6Wag66Pyv

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1