Extracted

Extracted

• • Target

    40fad2c24c3a6c8502d5a5255456478b44c3990177012f6b0a95c5dc89ab49d3

  • Size

    686KB

  • MD5

    aaece352b381652939d4e610a027edca

  • SHA1

    7c62501547213f24d22864d9d678a5229e40bc6b

  • SHA256

    40fad2c24c3a6c8502d5a5255456478b44c3990177012f6b0a95c5dc89ab49d3

  • SHA512

    a17f69f08af0869c96d03e2175b299c1d6c575201819c357610a23f2fc0d8585c5902b0aed014c879acf360fe370bb2248477953f924fb29f466fff4fb1bd827

  • SSDEEP

    12288:lMray905YUzgp8g7wimt2f/jZHRLhCZPeEJhip0HQ56XA4b2GfHB:Xy/gDimt2f7twIyHd

  Score

  10^/10

  redlineborisdogmadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1