Extracted

• • Target

    a83bd7a9ab736094a67ccefc030dda7a3081ddd2a0576e28dd096704055e4f65

  • Size

    392KB

  • MD5

    febafd1696697cad8e055755e9ff1afe

  • SHA1

    0222b26184220d7818dfe60c9107956b883a55fc

  • SHA256

    a83bd7a9ab736094a67ccefc030dda7a3081ddd2a0576e28dd096704055e4f65

  • SHA512

    6accc8b5182b200cd38f4e6974cf7bb44a0619e36344f15bb92a4e4ad69633ba8d6aeb2023de8b8272caac96abbaa1ded85fa2a84e79bf697142d0c3d2509f8a

  • SSDEEP

    6144:K+y+bnr+tp0yN90QEvaLeaUAjviz02E9+zqBbQlbJVeAJT8zl/D4aolh64:mMr9y90ueaUAjY029aQp0zWa4

  Score

  10^/10

  redlinemangodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1