Extracted

Extracted

• • Target

    a5e032beda3bd863e06d5398aa15e1e5b8223cc0135aa2055ea5e6cf326c025c

  • Size

    558KB

  • MD5

    ca0807c780ae67100d8a1dbfeeeb3e36

  • SHA1

    211c9f17482720d835fce0e58ddd43b594156cf2

  • SHA256

    a5e032beda3bd863e06d5398aa15e1e5b8223cc0135aa2055ea5e6cf326c025c

  • SHA512

    52f8c5f879ba8b53c8b53cd2e0ccc4fdc14538a7374b319d0246ff01257fe3b4d8ee921d325e869a2f7ee751ac0fc7777fd0b1a385e26eaa22f3a6cae96cca82

  • SSDEEP

    12288:aMrey902vJYVxKTnvib2uX9z63+mI09X5QnW2KzrcIsmRNqD:8yZmVcvil963F9X5QW2KlsmPY

  Score

  10^/10

  redlinefudmishadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1