Extracted

Extracted

• • Target

    b4ba168df7c77cb04b923e0e21095bc4c496f7c2916911b925a49245bcb58591

  • Size

    684KB

  • MD5

    c70f0639cb3661eb7bcd2b865a719259

  • SHA1

    f6577b23fecd42fc06b219af9a80329936bcfcf7

  • SHA256

    b4ba168df7c77cb04b923e0e21095bc4c496f7c2916911b925a49245bcb58591

  • SHA512

    9e74430ccf19799b4f28c891474c78a93dfdee64704038a944718c6114580401748a0127670c3d0d0158a288802370829cd5692a08011e57e001fe40f3ef2af3

  • SSDEEP

    12288:32p6IH/YF4pPp9BkMNVxauA6aFKm941l3qrKaPG4Lk2faSKVJ8ekcxAe:32zpPpnkOVxa/68KZl3UKaPG4Lk2/KVf

  Score

  10^/10

  redlineborisgenadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1