Extracted

Extracted

• • Target

    0047a120f6e8e50c4c3f32e36afcd449954a8fe754e96a1ac91e4d9c04de377e

  • Size

    689KB

  • MD5

    719dbaf91099132827a59f330a83e749

  • SHA1

    b69bff08f10272e9b6b79446d21728a36b8a9f45

  • SHA256

    0047a120f6e8e50c4c3f32e36afcd449954a8fe754e96a1ac91e4d9c04de377e

  • SHA512

    ac33dbcf6886cbeb80162d28510f6a2558f7ddd44c0c56ce2e73e3d42efb40f6219bfb89bf300a7b69268871c32ce08f63efc03afcc850190dc2c530453559af

  • SSDEEP

    12288:BMrmy90577tlRPulRM6szyv65hLuE+K3huSvdvRvNipvXqmJsvVFxtfigaP2/S1B:7yWplEDMtuifa7KRuqCvamJsnxtagapB

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1