Extracted

Extracted

• • Target

    80b99c541fc146e3cb7bb0545def0b5ac2877ecf726828a3328ae746f8b10b64

  • Size

    537KB

  • MD5

    30fbdfa08a52c8249c29fcd242c421d6

  • SHA1

    4304c3df69f08f513f4c83fcd3e9cca9abd58268

  • SHA256

    80b99c541fc146e3cb7bb0545def0b5ac2877ecf726828a3328ae746f8b10b64

  • SHA512

    da3033709daf6089af11e95036bf959e098b03ad261a0c6ad9073b67d1e604c3aa1666f044435b0074f99532dbf4c6cbf77a1a1366209d228937c9c70058a139

  • SSDEEP

    12288:KMr4y90+D+wBVOgO5LvLNlITZYAVLpenLUYLR:OyscVtOZvplIaAVa9

  Score

  10^/10

  redlineformarumfadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1