Extracted

Extracted

• • Target

    42d9871044423418b99116be419b29d27675ca37d0abde1b398e1029bab62447

  • Size

    787KB

  • MD5

    7a7a25999689db2f7c96fbf52d6ed7bc

  • SHA1

    c5bc42070b267226413a9251a014030db6e617fc

  • SHA256

    42d9871044423418b99116be419b29d27675ca37d0abde1b398e1029bab62447

  • SHA512

    e13bd9536a9226f4b322276a915ec595e8aee16ac8bd92e1438ac992248e5140c6d995250fe3f55d5079e9d6e146614d9d34978600de670d083964d7e2fc1396

  • SSDEEP

    24576:6yoPQrG/zvBPB3VhKF3f1FnIC617Kweipy:Bu/zBPFaNFG17Kfe

  Score

  10^/10

  redlinemangoritadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1