Extracted

Extracted

• • Target

    c91e726cebfd56f69b5980b49c006400d4a9442d37c1051e88ecc5c20d88dc6f

  • Size

    536KB

  • MD5

    3f030dbd0e336548485026d92170f438

  • SHA1

    515d9605bc760bb0d5e300a34f194cf9f1503569

  • SHA256

    c91e726cebfd56f69b5980b49c006400d4a9442d37c1051e88ecc5c20d88dc6f

  • SHA512

    2ee885842a538a0766b5e663230c4bae875eb976536b709cceae819a50f9b9e57f5be481ceedb642296dd971de903edfbd19f79c64aefe9052376a7851148d92

  • SSDEEP

    12288:wMrSy90yGSgMoeRJLfYy13CKPPR3TkR8JM:yyWebLfYy13ZPPxTJM

  Score

  10^/10

  redlinedownpolodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1