Extracted

Extracted

• • Target

    7da4ccd41b138751f8ade5ba9d0cad3ced39aceb06f3b5602a9aeacd1b5a6b87

  • Size

    550KB

  • MD5

    029f316aea7eb962a6c3b9b179e629ab

  • SHA1

    749f3a360d1546bd0e325a9365b4a250515c3553

  • SHA256

    7da4ccd41b138751f8ade5ba9d0cad3ced39aceb06f3b5602a9aeacd1b5a6b87

  • SHA512

    f2b64bfe28b250b7ccc29f00bd683de6a4ecaaca94face39a682b4c680030f8af3533a5d9757a46666020d28d80bce04a82bb23d131bed4ca4b6b6b35aaaa95a

  • SSDEEP

    12288:PMrvy90ujTdVxXSb+hngO/nSXWf7aGmcjJR/DA7:wyFjJVNzhngywWDa3CC7

  Score

  10^/10

  redlinefusanocryptdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1