Extracted

Extracted

• • Target

    5fa40296f35877388f8d71e9f8a954988c89a6c45d5d83837f7c2bcf9d017003

  • Size

    474KB

  • MD5

    a6d3038160a97f2a40625e5b78536a49

  • SHA1

    774012817dda480f33ca3405d7fd3725986ec8ef

  • SHA256

    5fa40296f35877388f8d71e9f8a954988c89a6c45d5d83837f7c2bcf9d017003

  • SHA512

    97717441f06ef36fb35ef6f83cbe8e9dcdc2ef91b60fd94c1abf4425060d58c755f683862758429c0a06592dee39d2b74328141fcdb6a2f7ce3634a9f5b479d3

  • SSDEEP

    6144:K5y+bnr+kp0yN90QE6gMYyeK3zoQLoyS6PnFUw1b4viT3F6gX+mFY:/MrQy90ogKeovbnFnd4aT3Uy7FY

  Score

  10^/10

  redlinecrnnfusadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1