Extracted

Extracted

• • Target

    e10e909d0033602dd871da9242fda9d9a5a74c2bf69e7042f7b76f60968f1546

  • Size

    690KB

  • MD5

    52c91da660906057602e522c57542c83

  • SHA1

    8d319b0c7f200e051aaf283f00274c743095835c

  • SHA256

    e10e909d0033602dd871da9242fda9d9a5a74c2bf69e7042f7b76f60968f1546

  • SHA512

    124956129e4566653fc60b3cff4c2d8c7a95c7961b855f22c0bf1da1075d867f1c5554d135b98da77fd838ea8f3ac2fe99c9814e0d72c1221fed90b219e52c38

  • SSDEEP

    12288:gMrwy90VdujV5qArPZshFyy65hLuDULoVfLfBPm2DmvIoF6kfigPKOSO27ks8Ha:gyEuyArPZnhfaeOZPtDmb6kagSO246

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1