Extracted

Extracted

• • Target

    8ab4b4260e5ffab082f9ac84911da41a097def28ceddf50c640da37c87118ed0

  • Size

    908KB

  • MD5

    f6836ca041ef5a434e34bc103252b416

  • SHA1

    e8ba2dc2e84238d206dc4b0cc176ce382d986c83

  • SHA256

    8ab4b4260e5ffab082f9ac84911da41a097def28ceddf50c640da37c87118ed0

  • SHA512

    6f048a9c874cd5b804bf623de2363908862c76b10d87a85af364375a4ad289035e45fc72da2f66d7558b3bfc47d52274b6afa2c61eb545e27bba40b6af6bdbf2

  • SSDEEP

    24576:vyBxBpHX+AgH9HxMp1VG23HcaNoFqi3otJGoa:6LnOLdHcl3wtaB

  Score

  10^/10

  redlinedownpolodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1