Extracted

Extracted

• • Target

    f236e2ac8ae59ad6f69e1cdab9f5bda571610dfccb5fd61fb2d7422b640caef5

  • Size

    713KB

  • MD5

    ead56ee95babb18a07a095a4e7676af0

  • SHA1

    1f3f877e539ab73d68ac713e7879a6526c3711a2

  • SHA256

    f236e2ac8ae59ad6f69e1cdab9f5bda571610dfccb5fd61fb2d7422b640caef5

  • SHA512

    3a8ccab2b1a7fdf5f43f55fb0a2f84b71eabb373bc43386e6e7bef36608c5dac3f144b6ed9c3e4939e33e4f6debdc40acc1266a7bfadc24288f1a511da3cc182

  • SSDEEP

    12288:qMrSy905LaamLIGILCKxorB2TM609DHuvJPvoI7J6uJG+xMv7ZuRfigX8F1vzrqt:QyhFI7LCvoQSRPJ6uJ2NuRagX8F9Gt

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1