Extracted

• • Target

    a5f5a25c64b86226a72d0384537ee3f192888dc6bbaf578540e62b33b41a0db0

  • Size

    557KB

  • MD5

    64b8a2b12fc23f36673e697d5322ff6a

  • SHA1

    a7d176bcb384b3513a2a0bee8a08f4a8f857cbd9

  • SHA256

    a5f5a25c64b86226a72d0384537ee3f192888dc6bbaf578540e62b33b41a0db0

  • SHA512

    13aea8b46a6dc93c8bb54838f6310f1bf45d06c32d9bbcd8fb5fc779e22dfeeed21362ef2d104af3bf1e9ebec305a5c26549c731c643477107d7d507a8a93285

  • SSDEEP

    12288:fMr8y90k39QXbowIqO74fTi481fVfSpIwyzf67H2:zyBQrJILM8ZhSpIwyzfEH2

  Score

  10^/10

  redlinefukiadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1