Extracted

Extracted

• • Target

    d1c0df278bd72c1e36b6fe16af3fd155f599119638b08164c5e11d43f73ad848

  • Size

    689KB

  • MD5

    74780b22e152731df7877475f2f089a6

  • SHA1

    5c066a650bf3b608f9362bf3a7004b36ce79e344

  • SHA256

    d1c0df278bd72c1e36b6fe16af3fd155f599119638b08164c5e11d43f73ad848

  • SHA512

    1004c7bac18f4a0b903e301217caaf8c007ddba1b540ec5fbfe2e0909fcce7fcf83a87c01ffdfb6d7282fcc1d088b177e8ae686e17cd02a6b8b576324cf776b8

  • SSDEEP

    12288:tGwUX0PE9LEv2jYWT9BY4DvfOkRTJDfXR0cMQ18gJl24dAIrO:tG70PWrjYG9e4zvDhRGgr24d1O

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1