Extracted

Extracted

• • Target

    173ab9cdcc070fa57f023bc40ce6d682637bcba157692d48df6f307cf6d5b4c7

  • Size

    688KB

  • MD5

    3d980746adf97db0b13504ec25acacc0

  • SHA1

    9184ef6610fff10e1eb1ace8ae8a4852f0462e4f

  • SHA256

    173ab9cdcc070fa57f023bc40ce6d682637bcba157692d48df6f307cf6d5b4c7

  • SHA512

    9fa3b9b31f0cab146e2d4370732cc84a32adfeca06ba15479f7b083e0151132850c2f597f36e8f9b4bcca6bdd41699734c47ad7176afdfd5550ff4319036b988

  • SSDEEP

    12288:mMr8y907ABWAyemwKwgecmyY65hLuuCW8+epBgiFeuCpmJEvrFA2figKgexOJcjX:uyDcYgeEXfaJ+epiucmJExA2agKPyk3

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1