Extracted

Extracted

• • Target

    2afc5d204727cee1a46508950d2eac1abe8bc442585c79bff3fa9501b6748816

  • Size

    536KB

  • MD5

    0fe44d68791447dec0357df7b686b7b3

  • SHA1

    bc8f58504a3627926d3c9c4491bbbf48ac749623

  • SHA256

    2afc5d204727cee1a46508950d2eac1abe8bc442585c79bff3fa9501b6748816

  • SHA512

    59a9ee15d1777b3aa065085b6d2dfe153ee34c27c253ee4669358bd9f22c6f4593d0ca795c56645387f4dad5dde99d32e5d234fe0890dddb7bbe94e34d6469f0

  • SSDEEP

    12288:TMr9y90w9WjDKYJr4KZBZg13ErwVJyWsAY/Ni:6yh9WPZkKru13swVJyVM

  Score

  10^/10

  redlinedownpolodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1