Extracted

Extracted

• • Target

    732ef889507ec5d25ebc37df046636630ff3688bbc31791222768c37e12adf3a

  • Size

    474KB

  • MD5

    d52e36bea505f6b3667df7bf952ac605

  • SHA1

    65bd420affa9b922a094c5a484c0b5d11cb96497

  • SHA256

    732ef889507ec5d25ebc37df046636630ff3688bbc31791222768c37e12adf3a

  • SHA512

    4e9aefa5c342f85e3586099f495970375ddaaba1bb9adc6130be54df3654ded02993fbcb75cc57dca6ef0a85d232ba6804c7f4defff41f8013caae5bc648ec4e

  • SSDEEP

    6144:Khy+bnr+Yp0yN90QEBIYWiz08QlRuPsYzz7xlPJXmhjx+5wqWoWKMScl6XkN5HkQ:DMrcy90xz0Sz3HJAx+5WoWKRjkN5EBm

  Score

  10^/10

  redlinecrnnfusadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1