Extracted

Extracted

• • Target

    11930343036fdc5a939cb9204ddda2afb77bea60a1ddf80c0e124d98dba8f508

  • Size

    540KB

  • MD5

    dbd4a49a01bc56e9f064acfa41e7554c

  • SHA1

    d386a6308131c651e2f5bb781958896af642d7ca

  • SHA256

    11930343036fdc5a939cb9204ddda2afb77bea60a1ddf80c0e124d98dba8f508

  • SHA512

    600c10e27f2d7d77a4ab71c00016e9101e95c5a9833d808d231f4e31caae729e0e1ac821d8a30dc95237fa51956ea0fa68977aec9bf111c04c36fdd2a16c9073

  • SSDEEP

    12288:dMrIy90DhzYHfWheJV4RMsPMkbrjySwvz01WRxig94:dyyxkfz+RMhMXyS8yWHW

  Score

  10^/10

  redlineborisgenadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1