Extracted

Extracted

• • Target

    3563dd9dcaab82663d0fe12eabdc8a5d8be00f85cb460ca6392eb99aa6affc18

  • Size

    550KB

  • MD5

    a85330aac14de3fa2beb5d4bbc822333

  • SHA1

    851821c71c2ab4c541f3272ece5fad50a6dd07f4

  • SHA256

    3563dd9dcaab82663d0fe12eabdc8a5d8be00f85cb460ca6392eb99aa6affc18

  • SHA512

    2fbe8b89f89bbc3e84e8adf2046ce2f195d3d10eb62e4570acce5cb64c9fac4396d0fb2ce105b0415e43b1e074f6401b3ed72a8468254252793bc7ce7abcf662

  • SSDEEP

    12288:gMrGy90eOq+owy2hc40JqzQ50canEcwBVJBui:WyRfwyX4aDmEcwBVB

  Score

  10^/10

  redlinedezikmangodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1