Extracted

Extracted

• • Target

    fe4c0883eba2c1f26dd638142a5c6f9d.exe

  • Size

    468KB

  • MD5

    fe4c0883eba2c1f26dd638142a5c6f9d

  • SHA1

    6417d8b40c8737d4219a2978d757724c8d5ee06f

  • SHA256

    2e94a777e3b86474913bb95e457207c645956b53f41a39149418d806be8a6aa1

  • SHA512

    37c72eaccd5352722c274e45413f4079f59cc965de867e82892087a74aabb5ee3edd5c4ff0d8913c8ce79c3e6c488b5f08a6a90a94139b89e8bea80f1b15ae90

  • SSDEEP

    6144:Kny+bnr+Cp0yN90QEfcIUP0LVPIkYFsmPBcLslftc1xUMThp1yc60+hc5Hur92zB:VMr+y90VZUMLVoGmPlftcnpKfF9FTK

  Score

  10^/10

  redlinecr10nfukiadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2