Extracted

Extracted

• • Target

    5eddb8de5af29a8f527d8957b6bb02469c97ad140ac6db1d0761dbacb3c55ff9

  • Size

    550KB

  • MD5

    78ecef1cd89a02afb7684ec290d1fafe

  • SHA1

    223b4ca5f95d2e99d439f17b50b58905436841f2

  • SHA256

    5eddb8de5af29a8f527d8957b6bb02469c97ad140ac6db1d0761dbacb3c55ff9

  • SHA512

    1f74ff42ac4d8f5ff22641151c53e95e95979399feaee0a588265368a6345d2faed8a0c0e9fdcea736bbcfe203db5a3c07ec549390013998a55ec5e0d7772527

  • SSDEEP

    12288:JMryy90IPt/nGcaNsEXJE8c5BDGxdJ0H25vL2LEEt1FNt:TyTGcos621idY0L2EOt

  Score

  10^/10

  redlinedezikmangodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1