Extracted

Extracted

• • Target

    3d0e6cff9587fa91670d90a7fde0735ce073e61ccee817f211ea84454029aa1a

  • Size

    684KB

  • MD5

    587ad47e78c448290603d8ef7de2c967

  • SHA1

    0488412ddbf9bad981ad298d4e47b06ea4fcbd40

  • SHA256

    3d0e6cff9587fa91670d90a7fde0735ce073e61ccee817f211ea84454029aa1a

  • SHA512

    5e92935d3d2617ac991888034240a0fbe1c76266251d74f26b87b380f5677df9b0670628a71bae0d867e988455fb19525206b42cdad08c8c4837f8eb00f697cb

  • SSDEEP

    12288:9Mrsy90SPI0Uo99LjLXNxUjJVjIoL7bpfIZ8BU7Tm/L3cpLDa0G:xypPAoHLXN+TjIodnym/LILDa0G

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1