Extracted

Extracted

• • Target

    781594ec30c0e99793b4f21bb39e27455449c19d301ddf9387499f9df9e82168

  • Size

    851KB

  • MD5

    b16eb924fc625fd173d8130d045be933

  • SHA1

    0875f590d392b687f6c53ea038df3e56dc2c277e

  • SHA256

    781594ec30c0e99793b4f21bb39e27455449c19d301ddf9387499f9df9e82168

  • SHA512

    c22c6f23232975ccc05b90854872db56b95b218bf260218e9cc89d1d33aae8e810563cf498059bfe685131160bbc3b0e705cc104fda111de671d85be88f6b222

  • SSDEEP

    12288:TMrSy90q/MxCxVrfp9qEqOzX03mafBwKVggCWLmQRLz8TIxOdJU+cU19TX3C5z:JyhVzyGX0WaJwKfCWiQJsI8dJfZxUz

  Score

  10^/10

  redlinecr10ndubkadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1