Extracted

Extracted

• • Target

    7a023534e2ea54a80b0ea8f51ea6d053ff27a353ff153aaccd85568f67a32aa5

  • Size

    469KB

  • MD5

    fef3d12a1fe20fced05419512b510cbb

  • SHA1

    269939fd78d1d8878ce10dc36c7920a4174cba8d

  • SHA256

    7a023534e2ea54a80b0ea8f51ea6d053ff27a353ff153aaccd85568f67a32aa5

  • SHA512

    cd14a90731676b3ac9ba9028bb61f499c61984e193898bdcb4245e7185edbf58a7efd5f275ef07045a815b279c7f940878a4dceaefadbbdf9a60117884b125a6

  • SSDEEP

    12288:dMrky90oZ78lEyTm+95+gWZr7Vi3Sgvq9qRnXQ:xy/1y/sgWjvOSqRnXQ

  Score

  10^/10

  redlinecr10nfukiadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1