Extracted

Extracted

• • Target

    812c86103c9e4bb29ffbb249cb8f057add2a08c1adc7d4050290c88b3307c28a

  • Size

    687KB

  • MD5

    a49ce846a74fce3f014bbf0ee3b32d81

  • SHA1

    f00e603f7d66e957d63987cb50024a8aa2a8f868

  • SHA256

    812c86103c9e4bb29ffbb249cb8f057add2a08c1adc7d4050290c88b3307c28a

  • SHA512

    13e7e92d9fe5f5cb7c3019f801120e7f935654a7b1bf99b2df546ebeee7f0105ec2d8a7db80d755e6fca90d15065a7294a80fd86cd20df9f7d4ef563a37dbc79

  • SSDEEP

    12288:EMrLy9059oa4lqp9H7FUk6yjCdUR5QiQvr8p5UqbuX8aepAKoQ:3yX09H7FljCG5Kr8PBuXLUoQ

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1