Extracted

Extracted

• • Target

    9beb50ef4dd96fedd79bf0161613e2c6ebcca366d872834f60e334a6bd43f4f6

  • Size

    536KB

  • MD5

    082adb1d82c40eb7fa5d46c06add017c

  • SHA1

    d66e5e3f961c68fdbf9db0dd1df8bc8309c1ab98

  • SHA256

    9beb50ef4dd96fedd79bf0161613e2c6ebcca366d872834f60e334a6bd43f4f6

  • SHA512

    2ae8ca7a6435dc4f65b408aa355e7b8e40061be8d3d3ba3ffa2d1fdaea7a424ce69523bd6a95bf0f6bf3a380ddcd051c0476ad56c15d65ef7cc22f8fb79c9c53

  • SSDEEP

    12288:RMrCy90TTeWasLf3aauIhYImSzluYDCxYsn8vE5NRar:3y6aW9bqaThBVkYWysLRar

  Score

  10^/10

  redlineformarumfadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1