Extracted

Extracted

• • Target

    c58130cf537cc12b4e8548f9ca6e2e4751470d4d8b3d6e2e6269241c50e7c6c0

  • Size

    536KB

  • MD5

    f307458eb41361619bf60020519933bd

  • SHA1

    718943506b1fe7e77991d551d3cc534ce1f1c88e

  • SHA256

    c58130cf537cc12b4e8548f9ca6e2e4751470d4d8b3d6e2e6269241c50e7c6c0

  • SHA512

    f8ccea0a1b25ce7814c58211531d62c281cdb7dd5f993a9753b2b4b8a8909af59ae1f55aaef0a62bee585265ac2c42089d2336f06b5f283f3bad8c3ca32d1314

  • SSDEEP

    12288:1Mrxy90i2wpf8/yVZzRUJtx/u4lqrqn7yR+fS:Mydpf6IFuJv/uKqelfS

  Score

  10^/10

  redlinedezikmangodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1