Extracted

Extracted

• • Target

    6cc3634e325d61b15d381dddf3e310934e9a7867e0539dbda2e9594bcd886f0f

  • Size

    686KB

  • MD5

    020b41b719333d381c415c7e6192e15c

  • SHA1

    91f02845a5c7d356d9804d9ea1876480efc127da

  • SHA256

    6cc3634e325d61b15d381dddf3e310934e9a7867e0539dbda2e9594bcd886f0f

  • SHA512

    5f5f73034cec619488335db25fb49319dba7d30fb93584d1d999ed84c193214e80eb6af5545f255f78fac82d1ccac32f593a5558433309fd3e6c1a0251d43d5e

  • SSDEEP

    12288:1Mr0y90C0Dp9p5O0m3eCaPE5NDpCxl6XU4b2cjsQ/S1S:1yvGp5+wx8s3S

  Score

  10^/10

  redlineborisdogmadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1