Extracted

Extracted

• • Target

    23fdac661c90e3af6866a8fcc3e0ddab5b089ae8f6bc72c9b85a147230d1c3bf

  • Size

    723KB

  • MD5

    ddcde47f6692d2ae06d0edd057424a57

  • SHA1

    b83ea67737aa7b63894e907516f44d23a6085d7e

  • SHA256

    23fdac661c90e3af6866a8fcc3e0ddab5b089ae8f6bc72c9b85a147230d1c3bf

  • SHA512

    915c9571d202e53c7440d3a8c5bf3fb56a0efc36da7297d3b90ddf2a586b548692ac831bb37d663cc3bc0f06df56a235c44577e6fc232032e8ee1fd847e77f9a

  • SSDEEP

    12288:dMoRPakqGEOj018dfVphyPcsyBWoNQs+HfwQ7rUONwnJqCTlqb5I:dMoEGEFEhcGSj4eUooJqnby

  Score

  10^/10

  redlineborisfirmudiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1