Extracted

Extracted

• • Target

    747dbeb0bcf844103eb156c4ecb15d29b53b58db9471d886c59d0e213d66fc37

  • Size

    690KB

  • MD5

    7f0b6489467e819a8527bedc227b8495

  • SHA1

    cd5ed1732f8ecaf38a3ff964356e83a27ddba6f3

  • SHA256

    747dbeb0bcf844103eb156c4ecb15d29b53b58db9471d886c59d0e213d66fc37

  • SHA512

    c8ea5948693d87366837031c72cda9f9fc609dfeba98084c59665bd13c83b9aaa6488ff27d09eacb63feea23979e9a0dfecac60bea059cda601aed31baae2f1d

  • SSDEEP

    12288:EMrJy90/8/IxcwbOJi9q0Lg2OLIHX6iyviFUgfig4Sh4qUa7at:9yCjxcwbJVLmIKBOUgagaqUa7at

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1