Extracted

• • Target

    ac7f0d050274681345ef43064504f971f05e2d65c3a9f590e43a2ec836d38987

  • Size

    478KB

  • MD5

    f2ac95c8b3ec4fb5c8bbe49dfc536a4a

  • SHA1

    bab14325d9e45d5438820fee13381baa5715fa0e

  • SHA256

    ac7f0d050274681345ef43064504f971f05e2d65c3a9f590e43a2ec836d38987

  • SHA512

    a926c72cd026b0c62666465cc0a006ea9f2e4b1dead643196f95f114a6d88c8b51f5a58ca5df989e197bc76bdd492c40949ad2fba74a4d79cc187e94fcb12b55

  • SSDEEP

    12288:PMryy90vlT0GlbD0GQsGKgsvR9VXiLh9:5yaAKbGs7l9VSLv

  Score

  10^/10

  redlinefusadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1