Extracted

Extracted

• • Target

    1ed1a1c68e418514a4d028ebe0f795e86992bc898e36fb612018f20f424201c5

  • Size

    689KB

  • MD5

    05bd7227c6aa4e5b88969a0f59b98299

  • SHA1

    ae30d8292556992f53fbadd0f7825c67f18ec2b7

  • SHA256

    1ed1a1c68e418514a4d028ebe0f795e86992bc898e36fb612018f20f424201c5

  • SHA512

    ac3db793d2493bdc07c0c3fd018dd919b4d206ce83589e126190f925eb270f9006614bf15278dcbf4768673ace5328a195ef2be80436c31179f76cbd2d5287e9

  • SSDEEP

    12288:yMrcy90P28ctlL3Quy365hLudFZ9v+DT4Tcd2bX5jwmJZvWFYQfigFtjbwlhszfi:SyfxlzQrqfadFb+DTybXpwmJZSYQagTk

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1