Extracted

• • Target

    e0675e5b80a6637c4cb279f070f68c3aff5adf7f93ba4b84ec608bcc9fdbce3a

  • Size

    857KB

  • MD5

    38406b6f196feaa3f0d82d3693786977

  • SHA1

    3f69a2fe5394f5eb9d3bcafb9595970fbda58026

  • SHA256

    e0675e5b80a6637c4cb279f070f68c3aff5adf7f93ba4b84ec608bcc9fdbce3a

  • SHA512

    31fd394743b6aceacba89f4d3be3167126db6b1766f149b3e66a4f2fe2ad351ba7d6f217668471cc179fc2ed61098ec59e7f0b97077c23a54b450e1bb72fe6c9

  • SSDEEP

    12288:YMroy90ltewCKRvpu1KCVdyU07hr1HokfrIafJpiBv2BRsV6+wywdpKvkNKZhsUg:wyARpu11dyUm0afJphH+Uds8NKjXE

  Score

  10^/10

  redlinelupadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1