Extracted

Extracted

• • Target

    1dce321e9c09c6bc8633f0ad63130fd80781fb78fcdfe88b9cb071ed7b28e5aa

  • Size

    682KB

  • MD5

    6e4d90b72b7e1d8f9879ddd08cbfc03f

  • SHA1

    b6a581f7847fafe0e8f2b96b6bc23be3f6789d48

  • SHA256

    1dce321e9c09c6bc8633f0ad63130fd80781fb78fcdfe88b9cb071ed7b28e5aa

  • SHA512

    c34b1ae13b25d44a0be4eabc8427bc3f0b0de4b5a31b5811e0d7ebf1b282344391e545bf51a7408c1b656a330ed2e8a0d1183d8fbf26423c0499133ec2c2ab14

  • SSDEEP

    12288:VMrgy905YxnIhfuX+Qhh2rxO5UfvsekC64MU7FmAL39RnHO:tybxnIhfPKh2rNnZkPFsmALNRHO

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1