Extracted

Extracted

• • Target

    8e4f32b52da8dbfbbac0fa513011c52903440144e48a94f0db6f17b0b05d4224

  • Size

    720KB

  • MD5

    5fdc91412168337202e3f2abefd6b2e3

  • SHA1

    bc30d4c58d1862d9b9a2d8a049bcc1de63a3c327

  • SHA256

    8e4f32b52da8dbfbbac0fa513011c52903440144e48a94f0db6f17b0b05d4224

  • SHA512

    d1bf4421efa5c83000a057a6c7fb694e43c93b52a26a25132fd4b5953a148bc3e8518befd17d9f0ca977c7a9763d226990f75b5d8edd4ebf582b0159fa7c791d

  • SSDEEP

    12288:VLrfxjYSBIeOllQw61Lt8xOWHF1GM12zDN9YolbvALA505LiBMTHo/922xOJFIu:VLSS3ob1hYP3nT6FMU2xE3

  Score

  10^/10

  redlineborisvizadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1