Extracted

Extracted

• • Target

    b116dca5816fe7806b6f11e3657132d43f864817c28da994bab28c7622ce8dc5

  • Size

    725KB

  • MD5

    8c095f6fd14d7a88014f248dc9c51b7e

  • SHA1

    47820ff0f838d7096b6682d2c50f93d609e9d431

  • SHA256

    b116dca5816fe7806b6f11e3657132d43f864817c28da994bab28c7622ce8dc5

  • SHA512

    42f40f27013013d59eb8f71ce38fe0a4f0069b0f83d4f51cec03c30b70222bdafed392a41208a1c7e10e6396c4f2cb8b14c19ad52cf3eb16b3faab0feb023dd7

  • SSDEEP

    12288:PcjNxg9Qtxdm1OpNTqZbKmwwekhcXqRTMT4zw34Oqf7uMS5ZabR4xe:Pn9QHdLpNYwwekhcu4qf7afab9

  Score

  10^/10

  redlineborisgenadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1