Extracted

Extracted

• • Target

    507cc4fb8d814058d24073f1face14581ff6f854e1770c01701f31c7a717ef0e

  • Size

    551KB

  • MD5

    177b41f9c6aecb7797ccc168dd2cb6c9

  • SHA1

    431799119918a96feea832ae5a8718c72e8d5014

  • SHA256

    507cc4fb8d814058d24073f1face14581ff6f854e1770c01701f31c7a717ef0e

  • SHA512

    d3ad45d90c25b2bc3c85ed2690286df8fdcca88da8177fcca692529527d96dfaf7f2e682f33c0a0920515df4be1f8805c82c9fc355c04cbf455e840c2ecd02e8

  • SSDEEP

    12288:SMr4y90Jcil2IAheH1KRbdjsWjX7sl+XlsEQyDTq7:eyuZAIAh21KRxjskrsl+WAvw

  Score

  10^/10

  redlinefusanocryptdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1