Extracted

• • Target

    5dffc7254a3daeec3b53cd052ce09422f89b2b2b96d42ed83441fd63750b74be

  • Size

    581KB

  • MD5

    4e284b1257451e69eeec6a0f70199f60

  • SHA1

    a1dde698c9cbaf62057dc5db558d1cc851b1201e

  • SHA256

    5dffc7254a3daeec3b53cd052ce09422f89b2b2b96d42ed83441fd63750b74be

  • SHA512

    74dd32faebae44f5632d00da15aedcf9e65c7c40ba2f0c7f3fb9a18d30b83b8f18260a58e17943b1f58bc5177ddebcd6e32d76a4d93881d4075c5648723b081d

  • SSDEEP

    12288:fMrFy90MhQtPwx7D8WiL5TNGJYpthp6Bo5IXUcn:OyctoFD8dZrCo5IXUS

  Score

  10^/10

  redlinemaxidiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1