Extracted

Extracted

• • Target

    4e49e6e529be010b31770ba07245b9a344d4c3a1930850d30170c66be3bb892f

  • Size

    720KB

  • MD5

    570b6fa5f5fff6d649fe6848e2de3ea9

  • SHA1

    f6780236f53c728a7b246952745380b50c531287

  • SHA256

    4e49e6e529be010b31770ba07245b9a344d4c3a1930850d30170c66be3bb892f

  • SHA512

    37f46c6b293fe74eb2477f3b4063420dcf1fb0cf048e3c7af6dba5af5ed297be1881854d3c943180f42e5bf03205fc23b8b60fdbbae269b44ad53d11b913b509

  • SSDEEP

    12288:HQOgkhaGZ6WVv8YbXfPJXjgYCws1k5EnUmrAB5viOAvthHI92v+sq4CSW/:HQ/GZLj50YLs1k5ae5vi7tt2kZJCl/

  Score

  10^/10

  redlineborisfirmudiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1