Extracted

Extracted

• • Target

    b0b8c16b31ce764fa95ea15d6c93c9199360ab16e1aae740353a095036dfe9b3

  • Size

    536KB

  • MD5

    710d92e7ba8a761457ac239d3dc8081f

  • SHA1

    472481658c139881cfc47f3c1bfd6b69c239b8f2

  • SHA256

    b0b8c16b31ce764fa95ea15d6c93c9199360ab16e1aae740353a095036dfe9b3

  • SHA512

    207a2251b79543511c664283113c876bdb89c094eaec138f68c8b90975f8818d4b60f3308bd50548d6ab05e3969ad27d39646b97552cacd189a949c975755ff6

  • SSDEEP

    6144:Kiy+bnr+Ap0yN90QEOdI+Ix/V1FI2eGtnq4ZBDkCT4QqyT/O7O4lvRg5dz2bU7pi:uMrAy90YI9PI2eSZBDkCTHrOROz9n4

  Score

  10^/10

  redlinedownpolodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1