Extracted

Extracted

• • Target

    8120c42640fa9125a10712a347b4736597b729cc86c4bc3fcecd8f10a1a67b8e

  • Size

    689KB

  • MD5

    5c27fd4f121ced1a04d79fd576b9e8f6

  • SHA1

    98b1b575828da6ca5b0f9dabb758ff2c670d4f54

  • SHA256

    8120c42640fa9125a10712a347b4736597b729cc86c4bc3fcecd8f10a1a67b8e

  • SHA512

    8fad776bd7898be65c5e0c4325d815007bf7de8ecb0aba74366bd86cab856f9ca5ad78b3a9d50fbc4aac355743e2b013d86b4f395de1b949f00c6ce6ced879d8

  • SSDEEP

    12288:RMrYy90JQ6Tbwtmo+aA2y565hLuAec4MN+D224z2wyG+JvQFrmfigxmBfSMg7NjR:hy76xo+DEfaAeg+D2ULJormagVMgiY

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1