Extracted

Extracted

• • Target

    f1096647abb000ac15adbc5681de744dd9659e39e5e450acbbaaece0136bd70d

  • Size

    546KB

  • MD5

    12214b46e4eff99f2d7e94def986907f

  • SHA1

    6e96e816f05293e5c06bf76ae16e45e96c5f9993

  • SHA256

    f1096647abb000ac15adbc5681de744dd9659e39e5e450acbbaaece0136bd70d

  • SHA512

    14ca6370bebb4d5258811a28e02fcba281dcef4fa3520421f50c1ce9128a4664238ad704f5457c0bbb208a1821a58b0afdd63661595f479e0e46a5b4d09ee73e

  • SSDEEP

    12288:IMrcy90IZlZVvk9QpH7Nmfb4sYeOJidaTIsaqAE2BfcMO:UyxZHVsuppmf5hKTIsaqAjOZ

  Score

  10^/10

  redlinedezikmangodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1