Extracted

Extracted

• • Target

    44840fc3b9f51eb7f123aca4c4b9a4ef37fade2a6ff00dee44ad25de71af8aa1

  • Size

    875KB

  • MD5

    3cd6f4cd3a34ff2345c0c8ecee1e1764

  • SHA1

    6947bd3c84a8784c3d22263a766d406645f58f9d

  • SHA256

    44840fc3b9f51eb7f123aca4c4b9a4ef37fade2a6ff00dee44ad25de71af8aa1

  • SHA512

    f87866862b280df1b691dfda3fad968ca231f7ebbe18b557b3332edec872740c021af2d05f480a5d4eb21ca05f7fa07df15dc6370d8a2da522f364b8b412ffde

  • SSDEEP

    24576:FyL56PV+V8I3CXDTkTU5+rlS3nx26n81:gL569P2CJ3nx26

  Score

  10^/10

  redlinemangositodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1