Extracted

Extracted

• • Target

    ce30c6c1b0168c376dca8094978f5256349e1d6da9d1cb62aa4c5fdf97e7d602

  • Size

    480KB

  • MD5

    e8845244456f345c5ecbc41d769d56d3

  • SHA1

    94551a00604f91f22eb2baeb5ad6422e73991d7b

  • SHA256

    ce30c6c1b0168c376dca8094978f5256349e1d6da9d1cb62aa4c5fdf97e7d602

  • SHA512

    e63d6a8e7a8c0288b6cde40480ce12145491cd12ab36fb3c72f9cd2d3e3d870837d85df7cbd649089e940d3ccf8d75c18352762188ffc1c8421b8c26bfaefca3

  • SSDEEP

    12288:vMrxy90OJXzuATwVWizRclyUzSyMDeHXyMchM8:eyJhzunVZNAlHXyHP

  Score

  10^/10

  redlinecrnnfukiadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1