Extracted

Extracted

• • Target

    35a9856a264c784f47bbcbd4eef791b26f101886d969dc7ac2b889ebeec310ff

  • Size

    686KB

  • MD5

    d54624144ba187a6cce0396595e480bd

  • SHA1

    bf22f5844d79e65ada6536674a2267df9d7154e2

  • SHA256

    35a9856a264c784f47bbcbd4eef791b26f101886d969dc7ac2b889ebeec310ff

  • SHA512

    7bb316053095c27bab4af7f3c72bd69390d0ff01b4c16d27e30b3061c119c0b6ddc34137a43a5f9d460093079d82d5f950bd8e948ca9049be1d70db6313ca05f

  • SSDEEP

    12288:cMrYy90FqOhxEPtFk4bOUoKZN+hD5b817VTIvziv8iBuOh5Qf:EycuY4bcC+VWI7iEUu

  Score

  10^/10

  redlineborisdogmadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1