Extracted

Extracted

• • Target

    946935121c3bf67cb870a8d95e72cd818107ebdb612374cf4b593650e64a98b3

  • Size

    690KB

  • MD5

    3aed01693363227121eba023185f22e8

  • SHA1

    66d76929b8b2720bd4d4031eb202f7ade1698391

  • SHA256

    946935121c3bf67cb870a8d95e72cd818107ebdb612374cf4b593650e64a98b3

  • SHA512

    943616561a3997103a47395c5b128ce36c1b4448bd86856f9c254b8a40be8059d75b6250ff19170a842bf73e72e0d7056f29a5f8c9495acaf76afd64f8e678c7

  • SSDEEP

    12288:aMroy90nC6T/dxMIO7Nm05yR65hLu9Ul7D0L8BZvbFVMfigK/e6sj03:OysFeLZi8faE7cSZRVMagR3j03

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1