Extracted

Extracted

• • Target

    96839af0c862452df4c7174046558bb5ecac81b946fc3be678d12959cb28b106

  • Size

    701KB

  • MD5

    a2e04ca89b75e907f1dbf7df13c6cd79

  • SHA1

    a74db2ebdb369c49c0945ab1e6aa426702ccf832

  • SHA256

    96839af0c862452df4c7174046558bb5ecac81b946fc3be678d12959cb28b106

  • SHA512

    9c2d9a3c318e958862ab7865bfd9c83f5a42ae83993103fc2393c0029ef9e2c0258ae53fa53442022903efd3f5c5c9b2dd25cc0f4411d7d4d38971334f41b314

  • SSDEEP

    12288:nMr9y90DrxGGlfwh4VvQiYhHTaR1xPGAAshMQT65HGhcl4NEtHXTJ1r6Jz:GyKxGGlfweQiNx9MQT65HGmOYHXvr6Jz

  Score

  10^/10

  redlinedubkanockdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1