Extracted

Extracted

• • Target

    5975715aa48f80d94702f93c64e27d07b68345812dd2aa53d4d22e4aa411fa1d

  • Size

    713KB

  • MD5

    6b054922153dbdc8e5a82dc96b0639b5

  • SHA1

    2181b7c3b85c639301d4ccba814d4c36092259c5

  • SHA256

    5975715aa48f80d94702f93c64e27d07b68345812dd2aa53d4d22e4aa411fa1d

  • SHA512

    1ad870131efd16ae5b924ebe101246ac6795b85f8ee65df5a664897eaf9832598584ed2b91f62a5fb9231b9b173e2f57a26b0cfbcac1005d7ace634e79b24243

  • SSDEEP

    12288:dSibsV1r1eXRKAaCwprt7hyU/+BGN95KKVLQFkW31fBBv409iS9uB:B4zr6EAaCurt9bGBGN95KlFJ39gc9u

  Score

  10^/10

  redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1