Extracted

Extracted

• • Target

    09d6f22b490413d01e4bd3f8a8685e9517a8eb8d4a474d7ff4f93bdf3ec570d2

  • Size

    874KB

  • MD5

    a06728886cad601ef98c7610a906e358

  • SHA1

    b8a293b64fe9239d0023be8c6f629de344da21d0

  • SHA256

    09d6f22b490413d01e4bd3f8a8685e9517a8eb8d4a474d7ff4f93bdf3ec570d2

  • SHA512

    202e07d7bab0dc1a8e0f840d8b13d5b05f638646094f3222565d050a661e89d0c7427d4459c2620d2e4de1d8033b5ecdd97b5317eec78dcaa78dfda133a1e731

  • SSDEEP

    12288:EMrRy900kdLQbKBn5qpxVdLaF8Vc06LMDL/NrX2kqB8SEtG4D0om/Gzuq/BUy51h:dyp+Ub+yooX/Bs8o+muzJ5L1h

  Score

  10^/10

  redlinemangositodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1