Extracted

Extracted

• • Target

    efb37a8180163e2406ee7c9c4f82d088c76a3812f8f93d673360ca75a063b13b

  • Size

    689KB

  • MD5

    c3edbd6e8a9cd01d918e543c2f565ad5

  • SHA1

    6c6b1b2c9d732f19af6cb93ca34fcecc35faf65f

  • SHA256

    efb37a8180163e2406ee7c9c4f82d088c76a3812f8f93d673360ca75a063b13b

  • SHA512

    7dd7db2f53f35925c44db8026c17697639da199db9bf3b9cd7138c5f2d3fe0a3d134dd98927b2c9f3d6e44b2dffcbd5547e36aacded10d18c998b0591caaa5da

  • SSDEEP

    12288:UGwUX0PE9LEv2jYWT9BY4DvfOkRTJDfXR0cMQ18gJl24dAIrO:UG70PWrjYG9e4zvDhRGgr24d1O

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1