Extracted

Extracted

• • Target

    7cf6b2b79674f32be1c5abc0f347a4bb7c3eaff305c627f65f5bb2a71cc681b4

  • Size

    684KB

  • MD5

    7096cfae1ecc7e0f9247805e1b4df74c

  • SHA1

    fed6f8f00fc173d00f2d0f8bb4ddf18b6063631c

  • SHA256

    7cf6b2b79674f32be1c5abc0f347a4bb7c3eaff305c627f65f5bb2a71cc681b4

  • SHA512

    45f36179f3dff79fc045e5c9c56e23bb5fb7f7a9646a6fa5322c26cbda5a4c44afcb1477fd483cebb754d0c3bf58b24857e73aea38d2a85544fc174829a3d52a

  • SSDEEP

    12288:RMrDy90sLFQwfuH0zjwFPv2Un48es4GlWTRsndOP6p4QWLHCz9n1:uyFBeHRPvyY4gWTR4OP66vCzt1

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1