Extracted

• • Target

    63562e10c0a5f879fe790a598bb14babd263f1671200b00a2010d4489aa7670c

  • Size

    647KB

  • MD5

    4141bfebfc950732ca2d37d6e9c8225a

  • SHA1

    683887c9f4522be1325187aab608c54ab7fd97d5

  • SHA256

    63562e10c0a5f879fe790a598bb14babd263f1671200b00a2010d4489aa7670c

  • SHA512

    5c4aea38af8f0d7ae9fa20189bcd5f52a97d9502c1f72b2ec9803ebddbd468356e5490dbe41fe47339e7e8823a98880639b31c312770fdfd8db95b8baf5d098e

  • SSDEEP

    12288:WMrCy903uUJ6kNnf/ccEykzS4DNWRq/JiZOJwqbwZosqSn:ky8lJRBW5moWRqdJ1u

  Score

  10^/10

  redlinemangodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1