Extracted

• • Target

    89ab6dacef6ad4a609c50311d700c19e84ff0926048f48492349e5bec153c9ba

  • Size

    580KB

  • MD5

    32374f95456d2d9de9b070b6319c9413

  • SHA1

    7203f9ef412c21b934ccdaad98f9598f46551876

  • SHA256

    89ab6dacef6ad4a609c50311d700c19e84ff0926048f48492349e5bec153c9ba

  • SHA512

    b07198e09dca2f6b8903929f0f7c9989e23170a3e1ffc7bedeb3ea65989599219c6d46ace1714e8e82b40060be5eb81295079e15fcbaa1bc7eaea6eacf6e894a

  • SSDEEP

    12288:fMrFy90ot6jKLn+mv+E9mFeafBReSWTQa8vECeDGi8js:yyLt6jK0ESR/Wc3deD3cs

  Score

  10^/10

  redlinemaxidiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1