Extracted

• • Target

    88f943cc3759a687d01e9ea30bc0a13ee18aa5d413d5426a93ca4f43566c6d22

  • Size

    386KB

  • MD5

    40263bba1e786ea45a1422a9bb8d56d5

  • SHA1

    383f1c84fbe048605afa5683f8c6608b41672f1b

  • SHA256

    88f943cc3759a687d01e9ea30bc0a13ee18aa5d413d5426a93ca4f43566c6d22

  • SHA512

    438ae5609bb38d9fdd3ac4679c9c5f88507a3c6c9a45b65dad5f778cfd9c76d22a5411535c7d374c0a4acc4f9da27a93462646424b3774ef6fa831e0fb319078

  • SSDEEP

    12288:iMrjy90r8uhxCpyPRFwmX8yxeaoWRE4c5:dyo7xCojwmsyMaoWK5

  Score

  10^/10

  redlinemangodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1