Extracted

Extracted

• • Target

    c9c805426fa702e9b3e985926ac0131c23ef4f2c0db3674b98ab9086ffdcfc04

  • Size

    688KB

  • MD5

    cfc03be97af9c2567daad5543b638500

  • SHA1

    5737ebcc47347186e17e13a78ae9000d78846933

  • SHA256

    c9c805426fa702e9b3e985926ac0131c23ef4f2c0db3674b98ab9086ffdcfc04

  • SHA512

    53419f96e13766cc833f686adfa08e0fcc4e7ad7b1f5064546d64f254e47fd16c84a8115720b17c2b4b65543a7fe03a8d12d9769fb262a1f9ece59daf569e96b

  • SSDEEP

    12288:ZMrMy90E1py0rOYHDkCe7ZQ1yL65hLu4EK3TuSvK0s4NymJwvVF57fign3LWkj0G:Ry99rOYHq7PWfaHKDuqC4ymJwn57agnj

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1