Extracted

• • Target

    54ae917dd7dbb2bfc8730aa99cb188bfc51f03e618c3546a831641d6d286cb93

  • Size

    569KB

  • MD5

    479baceb1402601191454c202e9c499c

  • SHA1

    b22b795434d5c608c71db0994252f9881063d7a1

  • SHA256

    54ae917dd7dbb2bfc8730aa99cb188bfc51f03e618c3546a831641d6d286cb93

  • SHA512

    a249b10516cab9f230a16186c29b7d8c48c8777e71b73f07e4df2e922c1da8421dfe762c12b76b6f5f9dfafe6993b4f795d52b55bf6960cc5cda24b9d25e72f6

  • SSDEEP

    6144:KIy+bnr+qp0yN90QEMEKp2ihfA9E0mFlP5JRZ+Ruz9SLMXqfeOOFyl3iRWYmnnGR:4MrKy90rahimz7AuxqVXSMh0rSmEPU

  Score

  10^/10

  redlinemangodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1