Extracted

Extracted

• • Target

    93b4d5522abb24b35fac5a3c61d2e7ea77b9fa3aab96cf34b9e8b0ce28739d5c

  • Size

    688KB

  • MD5

    2ca25ce83ab7d9ef5a268848cfe271e4

  • SHA1

    20af785911ad2af79d399629e852bdefcb679855

  • SHA256

    93b4d5522abb24b35fac5a3c61d2e7ea77b9fa3aab96cf34b9e8b0ce28739d5c

  • SHA512

    c7c1d44a0c22705ddccd628ddc303a2ec14a9a2da12d7f5743c9f3df4ce6040888b3cab830b9027b5501e53676ee0d47e3366b5d92417fd42d05864f373d9831

  • SSDEEP

    12288:4MrYy90hxnDKoOpGJGCGaT24S+sesV67acwGIwqf243xCbMSKbRxD5lf+IWJ:gye26JGCGaS4SzeM6+Gwe4hyMflxPmJ

  Score

  10^/10

  redlineborislenkadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1