Extracted

Extracted

• • Target

    4b0f5b50a3f33bfd567d4c18e739530558c3c5619bf4d01b13fd77cbf362b6d6

  • Size

    723KB

  • MD5

    3961d8bf1a35dbb03073dc76842681af

  • SHA1

    ab6deddb79fd65ee537783e3e7be13708326c4b8

  • SHA256

    4b0f5b50a3f33bfd567d4c18e739530558c3c5619bf4d01b13fd77cbf362b6d6

  • SHA512

    314197e637fd0afe16209b2f9c967db0946936c051533a24fb60d5cc1b7a204235522e476bdc8f9463f093622c0352ebc528a5ea7ee5bb03bdbbc44a48977213

  • SSDEEP

    12288:oquPpfwDP3V2l+yRowjKHl0y0N7q4UDmlP0uM3DQYtrdEe77dflfxsqRbVsOBVdj:oqnDPF8+eEFLC3FMuM3DQUf7ZfHsCRsO

  Score

  10^/10

  redlineborisfirmudiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1