Extracted

Extracted

• • Target

    84bb199f3ab9af880dbfcd1c13d9904aba69e8048f532969ce3ef702fcd77927

  • Size

    540KB

  • MD5

    06b5160eefb1d7c3e74974b674d45fbb

  • SHA1

    d3975e7b2abd6eb23c087b2f519afd048b01a0c0

  • SHA256

    84bb199f3ab9af880dbfcd1c13d9904aba69e8048f532969ce3ef702fcd77927

  • SHA512

    39e541c922b25d17ba44ff63f67ce943e399ef80b627b3d982ee42925a419f67e75b5b7caf245a301b8580a75b27b4810ec80d36c61d4b7655e11a9c9c596da7

  • SSDEEP

    12288:6Mr/y90VfiL0W3AkwKMSZad3S07Y702Oj96qfE7:Ryms0W3AC2S07Yob6qk

  Score

  10^/10

  redlinedownpolodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1