Extracted

Extracted

• • Target

    4530a53092a11d01c6a9f61b243d1a7d2d2854c707b9a029274ed7f5d99e96c3

  • Size

    475KB

  • MD5

    0b8ee8e849ad73ed3280aa17aaf26277

  • SHA1

    a1bebb9aa4b6bf7c80655bb66f0f71bcc6a440af

  • SHA256

    4530a53092a11d01c6a9f61b243d1a7d2d2854c707b9a029274ed7f5d99e96c3

  • SHA512

    6fff09aab4ff84ff061e94e2245391e6a072c080f36f977c96ae33452ea154c1b35681afba28ad4d8d4efb80e20572c0ec9483a68867be0d8010ec74122f4203

  • SSDEEP

    6144:Kcy+bnr+2p0yN90QE+wKCNZ94V4/ZBWQaPoqw8REIlxbHLxVLhP2az2Z4SEYI:8Mr2y90b9KOZBWQwtw8RLxRVoVZED

  Score

  10^/10

  redlinecrnnfusadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1