Extracted

Extracted

• • Target

    c974c52f0df897d0859f6f4b22910286ead75f7dab7d81ecfabd75a824ffec2f

  • Size

    694KB

  • MD5

    21bd8d289f91a023e03a73bca8e6d09f

  • SHA1

    23bee057bfd21a7128071b1f0fe4707f85144e70

  • SHA256

    c974c52f0df897d0859f6f4b22910286ead75f7dab7d81ecfabd75a824ffec2f

  • SHA512

    1cd62005c1ec1258a5a4ae7cf44c6975c17940dc37f7d9f19efde367a6ebb529034519142162cde44041a070aa0237e701bbb36491736fcffc04005920d724f4

  • SSDEEP

    12288:CoK7SPhtwSwKdNGHv+3jk5I00xBFQjwnS1PEqvMTsPpD6WdpB:+u5tjwKd0HWzk5NcKZEqldFH

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1