Extracted

Extracted

• • Target

    b5451ea81c5ad07c10c61b2ffe9838b8e194f49e6e3756f5747e1df95d25ff4f

  • Size

    480KB

  • MD5

    37ef0855ebf7a7b4ad949b470b32b27b

  • SHA1

    d8f926a7f7131d65ae9ec321de2c71e2cd9e5a3a

  • SHA256

    b5451ea81c5ad07c10c61b2ffe9838b8e194f49e6e3756f5747e1df95d25ff4f

  • SHA512

    1bfa047d8d4eb2e044775e2b9120adba4ffd3619f95f8ab0793119d9ffa789beb17541f1017f45c7d7365c452691ff64695966c9e9474b9895d18cd3fb0be116

  • SSDEEP

    6144:KNy+bnr+Yp0yN90QEfuLgJsho8vgJ42+CkVy4h6AKbmN+DotjQf0c0p/KAlEUSWc:3Mrgy90ZsK8IJCVP8AKKYurpykE96FM

  Score

  10^/10

  redlinecrnnfusadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1