Extracted

Extracted

• • Target

    023123d097ed6f42b15c785e51af6d27c093eca66bdd171c47246bd8939800cc

  • Size

    687KB

  • MD5

    e2d9a6ccd5f37e36d4a59f1e6f92e8a0

  • SHA1

    0101265f6d1c0e779f01933fe6e07ea79fe240ee

  • SHA256

    023123d097ed6f42b15c785e51af6d27c093eca66bdd171c47246bd8939800cc

  • SHA512

    d3d4e70e798cceece909f7734603330ac2d49fb0ea798024f18d9c7f3637127a8a59a170b167dd5c3a6e1d646e17673170db10348f206c3a26f86920e0963cb0

  • SSDEEP

    12288:DMrmy90JN34VxMn1nNwi7R/80SechIhPADiOs5Ts8tzaZ:NyvinRNwE0IPUi5gizaZ

  Score

  10^/10

  redlineborisvizadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1