Extracted

Extracted

• • Target

    c72b1bf46420b68c64963cf369faec64c709f2b66cf8adbcea28b62bfd196f52

  • Size

    687KB

  • MD5

    9a04e2ad90d9f2f8a62904c09aa903c7

  • SHA1

    b6956a2413712cbe76eeff53876b4130ae0db478

  • SHA256

    c72b1bf46420b68c64963cf369faec64c709f2b66cf8adbcea28b62bfd196f52

  • SHA512

    3c4a1b5be8005392c8322d12adbdd9cd259c8a96adc937787ee06eb790192073bb7e4473be6fad868284b4ff47b285056a73ea641cc4bd2643ca208783c1c1c2

  • SSDEEP

    12288:tMrcy90N6G78V2CIYxR6OjqWsokFFMmwvVHOKRA0lYGw3DSVs5A43MrbY:lyjJVxP7jtFGMmeHOGlpwTSsp8rbY

  Score

  10^/10

  redlineborisvizadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1