Extracted

Extracted

• • Target

    3141d7440a8639b50a6d412e72142542.exe

  • Size

    526KB

  • MD5

    3141d7440a8639b50a6d412e72142542

  • SHA1

    96c0de2895c0a42fd838a9d167cf26e63716b583

  • SHA256

    0196d177ad5c0fa45978723063d3ad7ad06e4972986b32f7b4ef9b6ec27176a1

  • SHA512

    127e42e0a6870f0d5449ba7361bba71a126c86cf35832bb9b5d7c282908f6775ac4936d987203dc36beecb469d5465c8895da533e1bf07c08f0d00494d72b48e

  • SSDEEP

    6144:KNy+bnr+7p0yN90QEjIvVQbe/MsgDmj/Vtp+aLurj3eEhH+6Slkqh0ZyZOLI5Y:nMrTy90+vVQZKVtU1rbFhe6skOvZQEY

  Score

  10^/10

  redlinefabiofuddiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2