Extracted

Extracted

• • Target

    8a503127c537128754773a4f5e352485d040e08a2b559493b4276b86607e9412

  • Size

    536KB

  • MD5

    ca9b45414cfe82c56d4a2bd1e70bd156

  • SHA1

    b25956905d4fddf57ee2c4518b94ef9be67a515b

  • SHA256

    8a503127c537128754773a4f5e352485d040e08a2b559493b4276b86607e9412

  • SHA512

    9ba65d7b2fd9d39b6a41d954d857310f8299fd679993d63fa582584f2e001057c0575e775f12f2a6e0c8b16a91c0a941bd4d92b32a7f78e6fe96cefe07c3affe

  • SSDEEP

    12288:9Mr6y90QhuZgnPL/lkQE9y55BBVacfBvODUDDQuP:by1Kg7GQrdJOIfQuP

  Score

  10^/10

  redlineformarumfadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1