Extracted

Extracted

• • Target

    842d638fd762a74244958b9f9ab835e2c06ba7629e665020829e4cdf2d920044

  • Size

    690KB

  • MD5

    101c9294987ed6ea6d7a7cbe8daa0bdf

  • SHA1

    6975b7475d651e7bda25bf665ce9716651dc144e

  • SHA256

    842d638fd762a74244958b9f9ab835e2c06ba7629e665020829e4cdf2d920044

  • SHA512

    1c1715804c35d76dac709d787a66ee2f79fb3a97d309e7f4251cb2d1656c3fb26aa55ad939afd3bfab1267ce619dcaf524261d5b002415bce3d80f46c2c43ed8

  • SSDEEP

    12288:iMrIy90kw0SdLMqXkuavkPCTk5XmCmsviFfLfig7e+wKTOc/:eyxkLMqXk1vzTeWCufLagalk/

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1