Extracted

Extracted

• • Target

    2c5f367747f714d02c9e493edf61bb49f96835bf3ae22d49d68cd107351a1daf

  • Size

    546KB

  • MD5

    ff1d3d26cf3806201772ae7ae9a91534

  • SHA1

    28459367411b63b1c5b5770af898d3f21dd55022

  • SHA256

    2c5f367747f714d02c9e493edf61bb49f96835bf3ae22d49d68cd107351a1daf

  • SHA512

    26d1f5e7e0119d3e56d141a63cdb09920427dc8ea97fe69e6ef5e740e72d6a27763a9d6f9287ba9474fe370e5c513eeee71dfb06e3525f3c3b15f9a755678ad2

  • SSDEEP

    12288:6MrUy90VBcQLxiYq4M2McvsYeEJidaRIeaqAE2B5mr8E:aymcIxo4M2Mbh8RIeaqAj7e8E

  Score

  10^/10

  redlinedezikmangodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1