Extracted

Extracted

• • Target

    50477583c55ecee2b480910922b0510e56cd429d91d9f125db1b15a2543e13f4

  • Size

    684KB

  • MD5

    5c0f5be301d949e789ae84bb479c27b9

  • SHA1

    7745e5731567135d9a6478d850a75d7c5047bee8

  • SHA256

    50477583c55ecee2b480910922b0510e56cd429d91d9f125db1b15a2543e13f4

  • SHA512

    a76f7b5f0f0354620ab43f2228382ad566632a99a7da52d7c3662a13f406bb818d153f8135cbe27e1505cc0c88bf5e866c489aded3b877a44338b0fd1c7b07bd

  • SSDEEP

    12288:i2p6IH/YF4pPp9BkMNVxauA6aFKm941l3qrKaPG4Lk2faSKVJ8ekcxAe:i2zpPpnkOVxa/68KZl3UKaPG4Lk2/KVf

  Score

  10^/10

  redlineborisgenadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1