Extracted

Extracted

• • Target

    c31e2bfa450e5f48ac56fe7758cc1246719f9bf67cab5464ed391657e422a3be

  • Size

    689KB

  • MD5

    a7e2d72cb3969823379b79a966b04867

  • SHA1

    e405c35842fa78de174c7b10716e310e710d28d2

  • SHA256

    c31e2bfa450e5f48ac56fe7758cc1246719f9bf67cab5464ed391657e422a3be

  • SHA512

    e9c039efc7c315530e4caab810a7a6376f0c3b441276e55f9536de854924a1e51ef4eefb8a8d8fabc001799559ae5511eb5bc8c0ebc6e76ad97f1b1dcf599335

  • SSDEEP

    12288:nMrAy90vKkbNB8MuNHWoXOVyxy5UHwVd+oNngbdBWgXbovdDOY:Hyq3X8pNHgcxoowjtnCdY6MFaY

  Score

  10^/10

  redlineborislenkadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1