Extracted

Extracted

• • Target

    52ca7344eca2a4182a89126542d2e96854439e54c3aba73e2699046f0c31aedf

  • Size

    551KB

  • MD5

    fef747038a6db99d89ee7a8c827faaeb

  • SHA1

    395fa04bd45d93b4d7e7de428c0cb0139e084d87

  • SHA256

    52ca7344eca2a4182a89126542d2e96854439e54c3aba73e2699046f0c31aedf

  • SHA512

    6a34ef7ce2c3aa36db92cdf1c9fbccab6bc3d6162ca86ac436a6875e2251495deb9d15e27afdbffb2ad49b08fd659d5c8cd61ffdbcc68e171a85d9bb704975de

  • SSDEEP

    12288:jMr0y90pdDVes6i+Ta7q7jA+KTYSeSqJ0J:DyCV6VTaG3UTYiJ

  Score

  10^/10

  redlinefusanocryptdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1