Extracted

Extracted

• • Target

    e9e786af7fb89ed0999f2c1f37368c8e33f8b2f97154bb712d017b20bb66ef57

  • Size

    683KB

  • MD5

    f356b5df869620a4edbd90c2a054ea7c

  • SHA1

    93081c44bd3e08298ef2ecb634ba25633176927e

  • SHA256

    e9e786af7fb89ed0999f2c1f37368c8e33f8b2f97154bb712d017b20bb66ef57

  • SHA512

    bb5c25934568dcc330534ff763579a4bcbeb5b13df1c246afce2054305601371471d3aaac4735da8953be52e70b2e1d3fabd209d9e7e44737874f52fb29480fe

  • SSDEEP

    12288:qMrdy9047D4FSWiEFW/TGFUs4LloxNsUAiU0RmwL38YDv:jyPX4QkGTGl4RoxNsUzzmwLMYj

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1