Extracted

Extracted

• • Target

    2ac33680ca703a5a88ac5b929dffdb0a72d8fe02738362363b03df72764b3b7d

  • Size

    540KB

  • MD5

    458f092a92fba6ee75e35e1ff4e803ed

  • SHA1

    437785ceb99963fff388aeaaaf2f4b14f16dc8fd

  • SHA256

    2ac33680ca703a5a88ac5b929dffdb0a72d8fe02738362363b03df72764b3b7d

  • SHA512

    f381c6a6a47c11b643c6a06afdc86d8b605676de60435e5cde0e15853f068cb3770004d87edef65eb4351c9317a5315cc75afb553b0ebcf8029d965c014e57aa

  • SSDEEP

    12288:SMray90QRExkTUVIsTiEsI17qm05GTeyAsB:Ey5RbTmIsGEsC7q75GWQ

  Score

  10^/10

  redlinedownpolodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1