Extracted

Extracted

• • Target

    0db00a2776aa25233f406bcc722b2adf39d9fb5dbbaacf24852304a8bc6e3b2c

  • Size

    794KB

  • MD5

    5b205d500d17bb64787be3452ea06113

  • SHA1

    be144de8005b064438d4be7b4a99afefee1d8c46

  • SHA256

    0db00a2776aa25233f406bcc722b2adf39d9fb5dbbaacf24852304a8bc6e3b2c

  • SHA512

    ea44d46a9b8b2e0ba7fbc379b1597f556cfbae7a624d4ed2b66a0fbc12898c80794668c6bb5328fe3f9a216c7c2add6b0c9fa16a6a0f605f01027addd6082e33

  • SSDEEP

    24576:PyEYX7KsoFnZRnOkEjgW0N9U8sHYkf4z:aEkKsoFZUz0gqkf4

  Score

  10^/10

  redlinedantegenadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1