Extracted

Extracted

• • Target

    9a500389599742761a169a3177c632276c733f21e72450b25b3cc33fd74b36df

  • Size

    853KB

  • MD5

    e3b831025da55214534edbe7690c3d51

  • SHA1

    975d832e3fd286f71cc1a7e1cc4e7bfedf974ca8

  • SHA256

    9a500389599742761a169a3177c632276c733f21e72450b25b3cc33fd74b36df

  • SHA512

    fe1f5b347d6dcac9b8877a5e17120d1a614eb41ae08d0b7c8fe6bfb82fe20089d6e424e27eda1dd88e81940200992361dab808258abfa7796bb6d7aa48d8f703

  • SSDEEP

    24576:Xyp7sLfgJc3RlngMh6oK9WjoXY04ShR1:iSbgShlngM8XXXR/

  Score

  10^/10

  redlinecr10ndubkadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1