Extracted

Extracted

• • Target

    45f6cf6a6de2dc7f20883717190c1b6aa53d752bfb34b6133289ad352ddeeb47

  • Size

    874KB

  • MD5

    2fc75620e894290190dbf4f36de0c449

  • SHA1

    3a79e092e06fd405767f06b39f636f53b9f41aaa

  • SHA256

    45f6cf6a6de2dc7f20883717190c1b6aa53d752bfb34b6133289ad352ddeeb47

  • SHA512

    af6ef7f64aca9ed246f98c8ccb9e16107f1d5be96ff12f65eea8fbd0532346971eb562ac4397dc7627f48ce76dc565ee2aab201a5474f28045bafb1fc5bcfb5d

  • SSDEEP

    24576:qyLmIqJW6pILWOLwkKS3huA3NEFCK8N40GKqT:xiI16pbjqjNuKq

  Score

  10^/10

  redlinemaximesudiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1