Extracted

Extracted

• • Target

    be8bf2a60c79321389a60a0f135dcc98eba6c8a38c4983aee1e6ab8c19486a9c

  • Size

    688KB

  • MD5

    a230bc6dabe2f562b8a053df731ea655

  • SHA1

    7f885bfba0f2f19817e933f71f5fe953cad0dcb6

  • SHA256

    be8bf2a60c79321389a60a0f135dcc98eba6c8a38c4983aee1e6ab8c19486a9c

  • SHA512

    eff553ba808f1f12e1a91fec8d7be1cf3283693646d39b3523330aa8ad271a883c16f2950905010e5dc0b301e5022994e58f3788ed9e81f1db9fb64589262356

  • SSDEEP

    12288:+MrUy90JzYHtRTSUuykGr53+M3wB31p6n3HjnJ2dkL+hSF6imFjIogrVEVx3BZ:myNpGyT3+FBrYzJ2KmcJSr

  Score

  10^/10

  redlineborislenkadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1