Extracted

Extracted

• • Target

    82b05752195402848dcc91797edc912a1a3c964d8201b6c9a725db6874917967

  • Size

    908KB

  • MD5

    703cc0ed4baef767ede96bc205aaf1dc

  • SHA1

    15906352c228cf45c733d4cc79ba75bf5812f84e

  • SHA256

    82b05752195402848dcc91797edc912a1a3c964d8201b6c9a725db6874917967

  • SHA512

    e002dc612270aa53ea10aa33bd2469d47ab7872c9e12a2c66509534facc34882c750e73ffbb177a56636da89c1b1adfc77fe1fcd5167e2507eb41cefe17c1fef

  • SSDEEP

    24576:+yegsB4KvrlZqCZGkUuRBEY36gjXVl4EROC:Ne1hRuU6SU

  Score

  10^/10

  redlinedownpolodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1