Extracted

Extracted

• • Target

    931a5aa34ba97db986011738eed333690c9230a5d1387792fd2ed2adbe42eea7

  • Size

    539KB

  • MD5

    1d2f18e3c7412d43f683b9568952cd53

  • SHA1

    12a59b9133cb59126f7d71d9ae38d7996110a3f8

  • SHA256

    931a5aa34ba97db986011738eed333690c9230a5d1387792fd2ed2adbe42eea7

  • SHA512

    fa233e99fec594281638e66c2665cba144867c4ee2f7dfd1b6497c434f151c94ef8d525a9e2807ba16e64c3ead2dfb8ad599e1adf376f5251329386d062c6449

  • SSDEEP

    12288:lMrAy904d+HTg5U31JoMJbcWS8OXMF7uERa3hJy:dyvUic1JoMvSVXEVAA

  Score

  10^/10

  redlinefukanocryptdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1