Extracted

• • Target

    61370bbef7df923020f0116188592b1c835bca741f8759c35ddfa3ee9c8a7571

  • Size

    409KB

  • MD5

    9d5927210a56530059e112e96d06af41

  • SHA1

    e8502e7c27850ec60caeac467d73f548bc0f6aed

  • SHA256

    61370bbef7df923020f0116188592b1c835bca741f8759c35ddfa3ee9c8a7571

  • SHA512

    218a7c3ab5c61cea5c8cc74680d121cfa91265982b64975d68c51c23389e2628b4bf12f060752b967d373d9137c4963abba2694465c39c5c2130c6febd6280e5

  • SSDEEP

    6144:Kay+bnr+xp0yN90QEV+ghTv6KSIlMnO+L3fhZYsyNCW9OZhVm9zXzFkW:mMrFy90zTCERuHHyXEyzxn

  Score

  10^/10

  redlinemangodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1