Extracted

• • Target

    5894bb3327f34b4f4787da947732bd47cf4bd581910d9a82f72b8131b5fbc324

  • Size

    481KB

  • MD5

    d3a2c22c5f91d855715286b1125c57f2

  • SHA1

    db3ceee7ded1badbb5b2d364ebfb538b999f1a86

  • SHA256

    5894bb3327f34b4f4787da947732bd47cf4bd581910d9a82f72b8131b5fbc324

  • SHA512

    f76886c40238da7f8bcc1560dc1d53f4efd1d975f3509b00d6aa3ac43331e332510e0d10af1939076b30c163ab330a76418a43e10ea4919c11864886f603a574

  • SSDEEP

    6144:K1y+bnr+ap0yN90QEK7mAYQVa2o4Rx+PHeJNdYNjgGFruMr47LsAs/pPQjq:PMr+y90k7mrrYYCSNjONL/s/Baq

  Score

  10^/10

  redlinefukiadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1