Extracted

• • Target

    ff4a79f95a3906a2ef1343304ea5fedb997c5063c5e9bf10a945941d809d806c

  • Size

    569KB

  • MD5

    06a432c66795c0304e1678577c61b65d

  • SHA1

    e551c2cbd44b06c16e8cbdd81e04c34f7c013f86

  • SHA256

    ff4a79f95a3906a2ef1343304ea5fedb997c5063c5e9bf10a945941d809d806c

  • SHA512

    b02f1f2cefc4db723d6ce0787b327fd02383d9f9bf50956e1711446d6b95ec67d59290b06b8a72897838d81ef752982fc4f36953f57b75f3bda28f7784fcd3b1

  • SSDEEP

    12288:GMrIy90oahimz7AuxqVV4IqrFJKy4TmHzTjYTflD:2y9sVAuxYArFf44zHYTp

  Score

  10^/10

  redlinemangodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1