Extracted

Extracted

• • Target

    07a44e730b6ce74444f627a556a6c9f2355a3abf0cd9e4bbc4ac563a44091b5d

  • Size

    689KB

  • MD5

    ab59048fb4173d37fd805389f3b781fd

  • SHA1

    e95c0cac6d47b4882c4d1c5c7a4f0b75d2902d7f

  • SHA256

    07a44e730b6ce74444f627a556a6c9f2355a3abf0cd9e4bbc4ac563a44091b5d

  • SHA512

    124ba90f165d97267a154766892cb2be36605910ac3e0d736877df6b3bd29154af97dc1684a18b8bfd5705206b43f41c65b41eb95ad90194ca313d05ec60bd5a

  • SSDEEP

    12288:DMroy909QF4EoaGiv29tyV65hLuvK3muSvtRpmcmJWvvFuifigflfRQdNjDqyO:XyPHoajvKkIfavK2uqtRpNmJWVuiagff

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1