Extracted

Extracted

• • Target

    18b762d62956c3c0024130b820b0a2bdae2ff75828ef9b241679b5b0f3e2a398

  • Size

    727KB

  • MD5

    31c87fee3f84a43d4b28ed34d04a3c53

  • SHA1

    593de781a7ceb8fe68987463ef14af518ff669f5

  • SHA256

    18b762d62956c3c0024130b820b0a2bdae2ff75828ef9b241679b5b0f3e2a398

  • SHA512

    956b8a20e8221bf02d7e6db16f9d83b9fdad37f5052001573b1beb6f1de489532bf3bc5eb8794604198bfaec286b6a1917a6dcea420d6ebbd1e02f0548fd3190

  • SSDEEP

    12288:Nm3zJAwWUtS5xtMYr103k+A9/zwh5oHgVHd+wM8qSkNqN2dJNRxz:N3wWUtGKY20+A9/zwh5xVHd9M8qSMqEx

  Score

  10^/10

  redlineborisfirmudiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1