Extracted

Extracted

• • Target

    8c2e7e6e6f869a3bd8ecede5edc311641acf728ab75be29919ca8318d4ed24f8

  • Size

    688KB

  • MD5

    43583372303621c7eacab22dba09c7f4

  • SHA1

    a5196ff3d26dd7ee94c6d7627e875733f9bb4ca5

  • SHA256

    8c2e7e6e6f869a3bd8ecede5edc311641acf728ab75be29919ca8318d4ed24f8

  • SHA512

    97eb790504495abbdc83e4bec4494d368ade4b1e9f86935f4434ca353d840c4db282d92cb4b18354946571fd71ae45ecd7edcf8be032e68501600e32ac89e922

  • SSDEEP

    12288:IMr8y906I5IzPc98hC4NzmUtAH7rQww/zHLL7EQh78BMqzhkeW8FS:UyNDcehC4NzxynQyQbMg

  Score

  10^/10

  redlineborisvizadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1