Extracted

Extracted

• • Target

    b4bfbf67c5aef1ad28ebc067b098633f36a0323a531e0e79dc3d7f2d5ce174b3

  • Size

    687KB

  • MD5

    3b1111aeaee23bbcfa5c6e560fb5e316

  • SHA1

    ca230c7489fb06670a58e86fab71d11353c9d74a

  • SHA256

    b4bfbf67c5aef1ad28ebc067b098633f36a0323a531e0e79dc3d7f2d5ce174b3

  • SHA512

    70901e5f0c23c33bba033bb03fbbd185493d10a61c9ad18ece2909bfac6ee056dcb4bcc2552a12faff6aa5e556bb8df3bec4774939089224426bc2e7172e624e

  • SSDEEP

    12288:DMr3y90BxF3aUGFMycPtDrK6YKgoGaXcU3HBMVz0kKzAh0LKXs:4yJUGFvcFDntqaXZ3+NNY8s

  Score

  10^/10

  redlineborisvizadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1