Extracted

Extracted

• • Target

    f45ea46ac1e8812b7e0e9ac8dd1ef0a1e114f7322149dcc69df1b961a9cd5b6f

  • Size

    687KB

  • MD5

    83fec38ebf06754be61396475bdac037

  • SHA1

    0e3fe5540bdcbf7a5c7bb61924ce3f4aea3e9499

  • SHA256

    f45ea46ac1e8812b7e0e9ac8dd1ef0a1e114f7322149dcc69df1b961a9cd5b6f

  • SHA512

    f518f87a021ae375bcca92cf3a9d81e70c711b032c8424b598ef276a99cf84b7599c0ea24dc0babacc11091dbab4a8c2d9dc5a187072db3ec1fd6a4e17252784

  • SSDEEP

    12288:mMruy90a5jAujJO9Wc5wAJuAPya2+KVGtEO5qlPL0a3dbHFq1F:sy/5yCAJJya2xGtPql4yhq1F

  Score

  10^/10

  redlineborisfirmudiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1