Extracted

Extracted

• • Target

    861fef9e6aafcc669b4cb5da2c73520ef812f7b4bff7d6f393e3ba2c09b71d38

  • Size

    579KB

  • MD5

    cedeb6cd97e46e98ba6d662f52dd5e18

  • SHA1

    1474ac4e6664bee15524c429125469e3b380f247

  • SHA256

    861fef9e6aafcc669b4cb5da2c73520ef812f7b4bff7d6f393e3ba2c09b71d38

  • SHA512

    a148e0a927ce8a72d7563754b1f710dff066e35eb686b652aa1858e2884d6ca09765b945281bc79492eecbfbc6855a16d19bdd84708d1b12d86ecaf546b0311b

  • SSDEEP

    12288:mMrXy90+2Vv+GvnAKV3zRZd67oxPoTnpU9k3SpZk0/VyUmn:tyoVFnAa7d60W98D6Umn

  Score

  10^/10

  redlinecr10nfukiadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1