Extracted

Extracted

• • Target

    4011153d88f0ee86c96fc32f11ae0c334b787dd4f1cde886540e83cb01567f13

  • Size

    689KB

  • MD5

    c85548b6946888e2a7fb365c1724d5cf

  • SHA1

    32c66e64d1cc558782cb306fc89cac89b8540623

  • SHA256

    4011153d88f0ee86c96fc32f11ae0c334b787dd4f1cde886540e83cb01567f13

  • SHA512

    1606f9b776900d5d537a48b3f3af09d9fc8ac2fcc387c63504d668be1f2df8c164eba7a45e7c72e8da30e0de5513c5c37209f5c496b4b809099395d7c158957f

  • SSDEEP

    12288:KMrcy90OY2IdlfEUuOyu65hLuWaMSKx3b1mdfOJ/3fvkFblfig7gTz9D5vmh/rfe:Cy5rVL1faWaLw3hOEP8blag8BD5v8e

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1