Extracted

Extracted

• • Target

    378f510289549a5b3fa6ef5b36fc5c68635c937c69bf4286242d2692c8de0238

  • Size

    546KB

  • MD5

    d9062673a8f0e842ed52212e25acb4ce

  • SHA1

    eb2098f25ba05f9c5bf4504fd37956ca5863e29a

  • SHA256

    378f510289549a5b3fa6ef5b36fc5c68635c937c69bf4286242d2692c8de0238

  • SHA512

    ab46a0c906df7f438fd823dc4416886eae5a0ca43bcf53d1944474f871b02e81a93627d9ca91bcbdb0ae7cc864254fb96cae69ce1b3c7fbb01dc74d2bc183dcb

  • SSDEEP

    12288:VMrHy90kbQQEVkSuiMNUprsenwTUaWFsYeoJidabIKaqAE2B6YxG:Gy/QQEjM+eAwT/WWhgbIKaqAj6

  Score

  10^/10

  redlinedezikmangodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1