Extracted

Extracted

• • Target

    ac87d48aa3921d2e6ba610a5389f35289ed211ab54cc01421ff024af82eeb593

  • Size

    539KB

  • MD5

    63a1c1f534dae84f4a295272e957bed5

  • SHA1

    9115b4a96bd4a0fb8b5e1a23a079c03ba3919710

  • SHA256

    ac87d48aa3921d2e6ba610a5389f35289ed211ab54cc01421ff024af82eeb593

  • SHA512

    e1059ff1bc2e31248f4fac635d01a8e3981cae6cd5d77fc149502cc9352fa873a5a0250fcc637fcffd920eec61bd733c8c9b37ba3256c729f22a23ecb06abb4e

  • SSDEEP

    12288:1Mrry90YswLycz2YFEiUxsSxCALt4zyj+d8H0rGJip:Gy7plzTFysAuzyCyH0qip

  Score

  10^/10

  redlinefusanocryptdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1