Extracted

• • Target

    48b7a4339262c7a533bc2cb07408e5ab4a7b8ee2a0709de3beeac6b08f9b14c9

  • Size

    581KB

  • MD5

    6e6a02cd249d1cffdb8e29513be7c3d4

  • SHA1

    e121bf3cf1dbc825ea84486e9c036386a6d35897

  • SHA256

    48b7a4339262c7a533bc2cb07408e5ab4a7b8ee2a0709de3beeac6b08f9b14c9

  • SHA512

    51e1c41306fdc93ae35eab38486fdd692a2ee494a7b6b0a22613750e6428685fade358449e3f81766c2ea706f7b46d1d1ef1faf0140e12c89170ed1bb3ad9a19

  • SSDEEP

    12288:YMrny90Lq5ZcTWzVzwKMXt1MPJMbDWyV0Q7tqwt8:fyQqjjznMXg+DhvK

  Score

  10^/10

  redlinemaxidiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1