Extracted

Extracted

• • Target

    0eda8617d518e4f31b8e1ac4fcc15ba605aebd85e9a17b45fb06fd609dd20dbb

  • Size

    908KB

  • MD5

    4cf914a08c2b997981cbf48c09ecca1a

  • SHA1

    02ae8d2f526de4ec8de960d01a578c768a595152

  • SHA256

    0eda8617d518e4f31b8e1ac4fcc15ba605aebd85e9a17b45fb06fd609dd20dbb

  • SHA512

    562c42c03ad1c81f1b07d9870f1a92696158bcadc4fcda7d331532ff26d3bd71957e2564bc8ef78e812d3211c484da0284c28064aa1cf44e13edc5ef2fda2c44

  • SSDEEP

    24576:kyu9/k5tERYeBq6QnprkEm11C7j1yHrIwlx:zuNsEZzJ184

  Score

  10^/10

  redlinedownpolodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1