Extracted

Extracted

• • Target

    2c2df89d08b34e00ae5ff58cca28fbaa23959450870782f72566f0c3dad9ab50

  • Size

    722KB

  • MD5

    e4c931e5e211b2810417ac83a6931773

  • SHA1

    78d357a4047258069fa024fd12208bfac16fdaa6

  • SHA256

    2c2df89d08b34e00ae5ff58cca28fbaa23959450870782f72566f0c3dad9ab50

  • SHA512

    1740a302717100951654037825e4093bec8fd5d364140c7e4d774c51fd9f7d9e052ab00b2369554a02838c7ea4e0fdb795f92d0f4d9c85310baac70320c96d33

  • SSDEEP

    12288:b1J7ppIKstg6eUo1UbOYIPrdHK939cA3mQo2PC5YCn9yAMX6w2Im3Gn9u:b1mKsq6ajPVQoY69ydqws3GnY

  Score

  10^/10

  redlineborisvizadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1