Extracted

Extracted

• • Target

    608d670510aa14c11c17cea561cca0a306010c1294ae99381273401ef0af11fe

  • Size

    812KB

  • MD5

    8c8daa3a29b48eb0e63d49fc799e0da7

  • SHA1

    86e4fc855e5c2a2f7819c8fe89086b4c319733c8

  • SHA256

    608d670510aa14c11c17cea561cca0a306010c1294ae99381273401ef0af11fe

  • SHA512

    70f93d4f401eea82e576c10231988db99d6f3e820f10a889c4ebcaa9b049cd05336446dd69f23ea563e0cbc7068e4fbb58cae08f8f67e59c0bd58009be6ff1c0

  • SSDEEP

    12288:tMrsy90sLiRhNSnxIFROxDx9NDHeYeNYYDp4B9clOGL1urk4+IVG6l/2g1UNH:FyKVSZx9NaQw4BdGLYrkelINH

  Score

  10^/10

  redlinedezikmangodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1