Extracted

Extracted

• • Target

    62b74d4f711ea26173aa7d2a429cc8adb664a2ab8579d710b59486f21d58e99c

  • Size

    725KB

  • MD5

    4888d4cf11b6590d374c6f9dc39f5c6d

  • SHA1

    ca87ad3fabb43f8fc1860f7325c270f0e3a14d18

  • SHA256

    62b74d4f711ea26173aa7d2a429cc8adb664a2ab8579d710b59486f21d58e99c

  • SHA512

    07f27aed308daa22397c3860c96d4fdf9160923c8ae6cbfe4e6392311190bc1ca87c7290a42f3ed7d8ae0d931c990398b7b8bc26540c6774211c09ef6fed6984

  • SSDEEP

    12288:DcjNxg9Qtxdm1OpNTqZbKmwwekhcXqRTMT4zw34Oqf7uMS5ZabR4xe:Dn9QHdLpNYwwekhcu4qf7afab9

  Score

  10^/10

  redlineborisgenadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1