Extracted

Extracted

• • Target

    31052c3a0d654d06de59f8a1afdb50e360e32d13b41c7348bd7a77f5250e1410

  • Size

    688KB

  • MD5

    e0bf7a34db811803c0c66bc06874e2dd

  • SHA1

    4859a31ca06d82d54d80b04477540bb4b9268ac0

  • SHA256

    31052c3a0d654d06de59f8a1afdb50e360e32d13b41c7348bd7a77f5250e1410

  • SHA512

    728429d5b4304972fcd7ec1530c2990b0875c236449787d60a96d131f2c147f5dd26ec2a062e78623edc56337ee0b47f3acd898248206b7900137b574f8eb09d

  • SSDEEP

    12288:kMr8y90vpiUHdUiiMcA7nDtiMoxVCILbVmPK204kfXFDBAon9Q43xTYMRKbIxzsC:oyQPcATDtdgVm/0fXFDGo64hMMw0xoc

  Score

  10^/10

  redlineborislenkadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1