Extracted

Extracted

• • Target

    02c39595e0c4b2a9e37bea25bbe4dbafdc4bf8978217b18edbf8652b550616e9

  • Size

    690KB

  • MD5

    dda2e29c4c3e859082cf5c09a9ded730

  • SHA1

    b76302590fccf549dbc21fb96a301e4a163c04bd

  • SHA256

    02c39595e0c4b2a9e37bea25bbe4dbafdc4bf8978217b18edbf8652b550616e9

  • SHA512

    9c43feb420d22b35d58beaed85a8146a0c07eac571b7ebf2f0b199c8de2a316dc2833aa83ea3397e623609d57028e18505f9b24d9c5c37e4b38a7c35e862bd65

  • SSDEEP

    12288:nMrgy901YicYgTFa13zEvfVyK65hLuXeaMSKx3PHXLihOuavBFd6figbjy/+PK7T:3y+TcYg0E85fauaLw3PHbGOuazd6ageT

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1