Extracted

Extracted

• • Target

    bb743673bd5344d740e79e1c314a74e57619208337bfaa611f50e583994d06dd

  • Size

    549KB

  • MD5

    ff874bf60e59c82483baeb13aae25af7

  • SHA1

    e576aaaea4b4d189ea24568ce56b5eb219928e52

  • SHA256

    bb743673bd5344d740e79e1c314a74e57619208337bfaa611f50e583994d06dd

  • SHA512

    37d4232a30ca4fcb6a62e031b5d33adac2233a599b9ec4000b4ca1eaacd71f6dfb803d182a1ac92955f0a43b44cc5b234b937a3c4cdc5619f939186fcb2c4828

  • SSDEEP

    12288:xMrvy9080zqrBoVBCzcnaEl0mbkK6+X0MYUSRt5fp+3Nqi+Q:GyF5GVqcna7M6+EHRtT2Z

  Score

  10^/10

  redlinefusanocryptdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1