Extracted

• • Target

    0369e3646d61a8123f8cc762b801aeb458b4149c08c5230755e98270a09ff366

  • Size

    482KB

  • MD5

    7f4aefdf9e6e0e75e44f32db775682c4

  • SHA1

    ff033a99eff70a62b688ef95d4ff1095a025a1f5

  • SHA256

    0369e3646d61a8123f8cc762b801aeb458b4149c08c5230755e98270a09ff366

  • SHA512

    074502504f463b5419ce22957e468e1f671cafcd27a0d4d232d885b5c8122e12cfecfba0673dd29b1794e1740b5f4c2224686a45bf2cfbe36b4f2af4efa1fdba

  • SSDEEP

    12288:/Mryy90TQQVx52N/vfBmNYSz4KU8O5Ic2:tySdVx6fB+JU8Or2

  Score

  10^/10

  redlinefukiadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1