Extracted

Extracted

• • Target

    6a58bc45a0c605b4b8589b950b2984a4c96d3155d058752677725fadf5dc4da3

  • Size

    725KB

  • MD5

    5ad5f6408ff1efeee39adff3fb294b56

  • SHA1

    91ac3dfea284ba364369717229ca651802e34866

  • SHA256

    6a58bc45a0c605b4b8589b950b2984a4c96d3155d058752677725fadf5dc4da3

  • SHA512

    5795210e531236b3537ceae673e75b2c1c22afe68a4eb2c6f7bebf46706e6e20267e334d8c0ba8d186dd477192c64166aac221b8ffc7c2c912494ec46ea19977

  • SSDEEP

    12288:GzfOxgdfLwGQzw+61sH4V3VreFV5KvdJigrMKZDD1hwABseUqhERaExy7GqB7K1o:GJdf9C01+qlemIKZDIABjER0B7K1opn

  Score

  10^/10

  redlineborisgenadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1