Extracted

Extracted

• • Target

    17492b7ea8a57c13fd562e17c33560452ce93345418863ffd2ca7bf1468347a4

  • Size

    689KB

  • MD5

    ed9043ed7e177d42f4cf6c383118e67d

  • SHA1

    ef28592eb32d735164b75c4911e3ce98e5650d0f

  • SHA256

    17492b7ea8a57c13fd562e17c33560452ce93345418863ffd2ca7bf1468347a4

  • SHA512

    ce9567425bcd18e34ce3776530d5cd23e4a1e8d38e0be98a1054a7898e7aed6a927b381685f3dfa3ec82c1a1e8b73fb0f0690fa9aad1a3f320345e30996164e8

  • SSDEEP

    12288:5Mrxy90Zll/I2GYo2yug496ieyH65hLuvwyobeyc4C0xmJ/vRFKCfige/E0gA:YySllw2loj4Q+afaOepv0xmJ/jKCagNg

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1