Extracted

Extracted

• • Target

    2fa7ab71d00285a74a2e4efc0e8d1e0c7ea8646b2ef045f1bd43dae3f5a32ed4

  • Size

    689KB

  • MD5

    71fe3a992f883413faad3e89a3a4d8bb

  • SHA1

    ba7fa3a1b5ed5c37e067d1b3c80dd7e6ffa1b3fc

  • SHA256

    2fa7ab71d00285a74a2e4efc0e8d1e0c7ea8646b2ef045f1bd43dae3f5a32ed4

  • SHA512

    1631a4ffac56f2f043a4a5562d3a222d407344d808a311d203d270705925b643d8a4ec13c56bc777e4ead99708ce6d8dbfa3417783e634c2c54a618103567bc5

  • SSDEEP

    12288:JMr4y90OwYLm4BZy2+yn65hLu+ZAMSKI3VDksvhtvIF2KfigoA5/PAq:9yRwvu76fa0ALZ3VDbtQ2KagT/P9

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1