Extracted

Extracted

• • Target

    8529b92831f9a84ed47c88509a494eac945cb3a16ccf163908ff443bff9fa37e

  • Size

    728KB

  • MD5

    636c8f792dc7e99aa3c1c3bf908a217c

  • SHA1

    8de6b5677390d07743854243a6597059b2ffe57f

  • SHA256

    8529b92831f9a84ed47c88509a494eac945cb3a16ccf163908ff443bff9fa37e

  • SHA512

    c24ed351b9b0109ca950606bb7b9a083d18785ccc0a2d0bef85872f7b5bdb2a3dcdd6a0c11fd37a7746bfa9d2fd522ccc9caf6abc18d60513122ae930fa00de9

  • SSDEEP

    12288:/M7HjeztCIzGcv+qAPARIv+kUdTPIdCdyTiAtba1JGDn4rRU2hdxs:/5ztCi27vRwTPJdyTdteG0LS

  Score

  10^/10

  redlineborisgenadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1