Extracted

Extracted

• • Target

    153347d9122ca383cae828a39092c1aa0c0fc15b00933116280f1622d0a3a9a1

  • Size

    875KB

  • MD5

    13353a99cd6501657b3842e47c3d1d07

  • SHA1

    7e8f1b7062c169e38fd169293ce2fba0cb9fae36

  • SHA256

    153347d9122ca383cae828a39092c1aa0c0fc15b00933116280f1622d0a3a9a1

  • SHA512

    d10c4f62c2582e1f6056e85c3ecde45b4c42faae37131ee0ada7d08cd2c8bfd1c9c68bf9082e8e24652f778e3e40608efccaa39800fbb64644e3f3d8f43a414d

  • SSDEEP

    12288:lMrTy90shOzIRSR/SjBHE8bs4ZN+2Ni9ScRwP0fSEMUxbn2Dhh8cWCgTU7AEr3Qf:eylOksR/SH3G2gSc+06UMhh8cZgTgE

  Score

  10^/10

  redlinemangoritadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1