Extracted

Extracted

• • Target

    fdaed2b15bf4ebc61b99a294dfc33e82643cc2e341c51eaae79295c185ff6d84

  • Size

    688KB

  • MD5

    dcfb4ffab47c9dc2174960f40b6dfefa

  • SHA1

    2e2b2458f8018201f0c005b2b47cdf79afb86a5c

  • SHA256

    fdaed2b15bf4ebc61b99a294dfc33e82643cc2e341c51eaae79295c185ff6d84

  • SHA512

    c343f3577cad86cfd33fa12bbb3fa6c7fb6182b407a77411ee6c3d3d3aaada31a7a3ae15f1f50916af2709c4ad75c3c56663391fbf893e6696158faf202e1bd3

  • SSDEEP

    12288:WMr2y905nYjtfNmXpkpVNSl/9qShOqIO3cyYzLmYGXG0aXFnr9:kyIafNeKN6ka5ALLmYGXNcnx

  Score

  10^/10

  redlineborisfirmudiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1