Extracted

Extracted

• • Target

    d62906d98cb4da493ecf57496a75754251b1e722d3ad183d3429c5c88347a8cb

  • Size

    688KB

  • MD5

    b254d548f860743b8ded8174f3ecdb1a

  • SHA1

    d2da541eb0d3beb63780b9063839067c4e98492f

  • SHA256

    d62906d98cb4da493ecf57496a75754251b1e722d3ad183d3429c5c88347a8cb

  • SHA512

    274f23a984f98b29b7323b4eb88e5c05c41887dccc9ead07306c545e37ed37f0176a25f80d0bd3438f67dd5f0b071bf3e766cee354afa89714d32ba1ceb45095

  • SSDEEP

    12288:0MrWy90oEr4rlDJtLIN7npqWnrne+wJhTqIO3XyWePP0aRkdrUnE:iyvErEtLIW4neDmzCPsxdrv

  Score

  10^/10

  redlineborisfirmudiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1