Extracted

Extracted

• • Target

    3542097662ed06c29fdc2bcbb996ee1cd93dc1545d822fb9f6c2ab4cb7c1785c

  • Size

    546KB

  • MD5

    0ee5b13ceca521d487fb54f2cc0ead3b

  • SHA1

    a0082b061e9d85027d9822cb1264292e9b3f4612

  • SHA256

    3542097662ed06c29fdc2bcbb996ee1cd93dc1545d822fb9f6c2ab4cb7c1785c

  • SHA512

    ff5f6bb3c13b11cc6fedf630d1dbb69ec6f027ab6015696f422c3d88ffba62551cee658645b60de9d74e2d77db17d7d523992881f3a9216e9e831e07d0055642

  • SSDEEP

    12288:ZMr8y90mulKkzTGzohUcJasYeMJidaTISaqAE2Bri5zJQ:9yAln/CehETISaqAjI1Q

  Score

  10^/10

  redlinedezikmangodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1