Extracted

• • Target

    947b00b735331a81bebf768f636888577d6076a753d5bc5a431aa12a6e695a0c

  • Size

    856KB

  • MD5

    245444082fbd0373c833a8211363b366

  • SHA1

    22dc628930b0636d6a78b115407dde07908ec293

  • SHA256

    947b00b735331a81bebf768f636888577d6076a753d5bc5a431aa12a6e695a0c

  • SHA512

    0de435510c279c9e5a337821305bf23507ea8f6c6d5f7ddb6ec9f1e38d88daa470aabf34e2f654d4018ba890eb46fc0fdd5809622ab3a844f3b41c92e778f00c

  • SSDEEP

    12288:6Mrfy90kZFRD800SFOWV9NuQ1ZXu4u3zii/3cxzc7t2TOpVKpQnZpoCVT:pyZ7cWOPQ1s4umi/Mxg2SpEaX

  Score

  10^/10

  redlinelupadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1