Extracted

Extracted

• • Target

    c56e97783408253eeba6f0c46515008f8f7af4d1ea8b36baf8fb74b0784e77f5

  • Size

    546KB

  • MD5

    091186aa650f22c4eec511e7d3ab3d07

  • SHA1

    b512ff78f1c38e850131ee6fe159cad056f40bd5

  • SHA256

    c56e97783408253eeba6f0c46515008f8f7af4d1ea8b36baf8fb74b0784e77f5

  • SHA512

    95ff58e7b1541da087d2379e50e886f69791ae71e8c80af237d54910926eaf9f43820c3a5d66dbdf86f17756a4a7a72d6f5dec096b7d4c09dd22ff1716d435b6

  • SSDEEP

    12288:GMrKy90FlkG3KblfzQyzsZBpiJ5xpqziL:cyGufz5sZHo5xpqzk

  Score

  10^/10

  redlineformarumfadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1