Extracted

Extracted

• • Target

    52b3d9bb74d3eb611d962c7be2272be9.exe

  • Size

    468KB

  • MD5

    52b3d9bb74d3eb611d962c7be2272be9

  • SHA1

    b3b5cea27ed4ce853dde2297bee82f450637f70d

  • SHA256

    fd8f38399b6177e82e47462be89e036cf84f959d9badb00af343db26a4226b1d

  • SHA512

    f7959f158d173f590fc7bde0a9a39d57b704b1330cc3e419789427f38941928c45a3d49f72aa1574e10fce2002b8669c2cee660e21b542cb9a6c3cddf816b74f

  • SSDEEP

    6144:KBy+bnr+hp0yN90QE62o3jGtjvo8xOk3wDgyrSd6axmKfgfqaKLvbmInqh7Yx2:DMrdy90RKOOCwsCSPmKuqt1nqtYx2

  Score

  10^/10

  redlinecr10nfukiadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2