Extracted

Extracted

• • Target

    e1c049e3ce597bfe4d28c081f0c821133ec836e2dd28e77738459b85322c994b

  • Size

    545KB

  • MD5

    ed143ab0dbfd960c19bcd1796a119bb5

  • SHA1

    9968a581e5e506f392de4b3e1c52d05063c38aaf

  • SHA256

    e1c049e3ce597bfe4d28c081f0c821133ec836e2dd28e77738459b85322c994b

  • SHA512

    cfa4055fc85c04dc6719e119fd9ee1a457ba57c2919eab1c1edd72045cb36b25bc510764cd601c0f4e71e2e6477775c64a457375c60465641c114e1748e6a56d

  • SSDEEP

    12288:UMrzy90b72Y8RL5A4BOeoU1qDFWAYUyMHKlZKPyi/dX+G:Xy62l55fMBFWAYUXqCPfdx

  Score

  10^/10

  redlinedownpolodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1