Extracted

Extracted

• • Target

    09036fd08fecceb00d564ddebce8638025d72e11e4a9739edb337356e90ccc0c

  • Size

    722KB

  • MD5

    091fdac0cd2feb4517d9ba43fdef5eab

  • SHA1

    38cd318b4b3a19bede6ab9ed900b8398a6072423

  • SHA256

    09036fd08fecceb00d564ddebce8638025d72e11e4a9739edb337356e90ccc0c

  • SHA512

    fddb8ad70f38f585f11957f4292d461ef4f1cd9bdfbd7707709a831d1c850f2c72078869adc22414966cd54ef027a8c92b74545693367ece7e44ebfca8befd93

  • SSDEEP

    12288:11J7ppIKstg6eUo1UbOYIPrdHK939cA3mQo2PC5YCn9yAMX6w2Im3Gn9u:11mKsq6ajPVQoY69ydqws3GnY

  Score

  10^/10

  redlineborisvizadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1