Extracted

Extracted

• • Target

    18302b89d5b57404956b1c0d63227990b1d54b4e8c9df72cdee42b7187a6b6a0

  • Size

    538KB

  • MD5

    4771315322a7be2bf5db3d7a3b017eec

  • SHA1

    ff7400c24b34d529a88a06e8ba77e3843e313c08

  • SHA256

    18302b89d5b57404956b1c0d63227990b1d54b4e8c9df72cdee42b7187a6b6a0

  • SHA512

    614e16e9a529c31019983adb96a3eee0cf0dc42e0e57a9c438a3778217dc0f56098063bcfed1f4f814ee525e7e845ffcc00b12e579f8c7cc2e6c3e90343a33ee

  • SSDEEP

    12288:pMrky90C7uEf+DGufElhlxYJGmr0N3C2zD9RMYF+R:ByP7uEWDG6ElvxYRr0NFF+R

  Score

  10^/10

  redlinedownpolodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1