Extracted

Extracted

• • Target

    b239873067b5ac7c9c6eecd9bda7e537f3801cac4f6a227119d99123b2aa4cb0

  • Size

    545KB

  • MD5

    c20cf71c0615fd11a60ae1317eb762f3

  • SHA1

    de0fd83ac1bf8c8a99c2ff65110ca9cf05cf7941

  • SHA256

    b239873067b5ac7c9c6eecd9bda7e537f3801cac4f6a227119d99123b2aa4cb0

  • SHA512

    9e33af4047a2501a6aa1d001e37b8c519c4811bcf8aec1168a032a27a2e6b4da44fa01b9b1148f8c777a74414c2d7d9f9b7e702156ede373ab62289b8f186b85

  • SSDEEP

    12288:eMr1y90UkMeUAEszapXdciZLJGAzDFWQp1yPGN3kaeOk6b:PyrkTECapXGMjvFWQp1wC3/eOLb

  Score

  10^/10

  redlinedownpolodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1