Extracted

Extracted

• • Target

    d9c5043a79fcb8db2bdd23866777414b4a9996b6259d9f6be8c3aefab5e42875

  • Size

    858KB

  • MD5

    95c163705d1f1efff0c3ada38bf839c7

  • SHA1

    922acba4966a9a62d357b9ee4f37493fcd2fb543

  • SHA256

    d9c5043a79fcb8db2bdd23866777414b4a9996b6259d9f6be8c3aefab5e42875

  • SHA512

    badfa3e018c4057bd9d1a4d467b1bb4a04e1559e245f4facde081972c4cf0ed1e97d1b3a3502eec270f5e877b28a29347ae3175243b791991fb7c67a022eb4f5

  • SSDEEP

    12288:dMr8y906EVAOQ4ZLTrrOkQD6uH+l6tC4glSIG31TvXVCQe7yIOVDbDbW8fe8oRNv:RyaVi4h/CDdeEY1LG3VkQe7A3fW8W8G

  Score

  10^/10

  redlinecr10ndubkadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1