Extracted

Extracted

• • Target

    16d10cee6446ae4f578bcdff97afd19769cce24e12855822f467255d6126499e

  • Size

    546KB

  • MD5

    d2389515eee84af92be1dbb85071712d

  • SHA1

    dffd8320eb10909af2a24dd4b2f5cd05d7f6fcf7

  • SHA256

    16d10cee6446ae4f578bcdff97afd19769cce24e12855822f467255d6126499e

  • SHA512

    8c21f27de569d190772784ea545b0a042f757bb702cc62efc0cfd66a48e0fb5b0aeec0d095a10728ee8352ef9f7a0f04f2458304d02f627528463ee239974a4b

  • SSDEEP

    12288:5Mroy903A6Da0lXJ28owtF58sYeIJida9IKaqAE2BY:hyCHaQXJ28hxZhA9IKaqAjK

  Score

  10^/10

  redlinedezikmangodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1