Extracted

Extracted

• • Target

    dbe58be8dd1d29b95b29470bded895eb4e56de9c8d0f78d556f5a97d19552738

  • Size

    481KB

  • MD5

    e44976bdb0218ad9048d8653f29ceb04

  • SHA1

    27016d7d97f0d48c44dc6b40644ba4534601d297

  • SHA256

    dbe58be8dd1d29b95b29470bded895eb4e56de9c8d0f78d556f5a97d19552738

  • SHA512

    e611e9492a29c7fff80270df923e369bb3d233797a7ea987966a93fa93e4734dcb6075c90810c79a4abb3505704188aa0cf10260a998dd2fd24ab4a019ff17fb

  • SSDEEP

    12288:tMrOy90Ou9D1WactFEZlbpV48QOoUbhGi:Tyfu9BrctFEr4c5

  Score

  10^/10

  redlinecrnnfusadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1