Extracted

• • Target

    b32961e850a340056f97ab33e084c51170fbb6f9a511f8d70b692179b7d35462

  • Size

    581KB

  • MD5

    52848004ea4103154bb8e43e8a8114a0

  • SHA1

    f0d7daacc37707f6c1c5af28bcb62eb9f5128341

  • SHA256

    b32961e850a340056f97ab33e084c51170fbb6f9a511f8d70b692179b7d35462

  • SHA512

    d83a6c94aa4ea9fae2a875b50582e2c0633b1153349ff2ffe80f30ed1fd938aaeee8c993800b5020f0a31b8283bae3a7fd9ee41b5f84aed1bdc621d54455111d

  • SSDEEP

    12288:6MrDy90W3w5pCyOqw1HVZSzmIfzRNvxiKl20kVrjvHwT:ByPmXw1H/SiIfzzvxiKl2vf/+

  Score

  10^/10

  redlinemaxidiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1