Extracted

Extracted

• • Target

    337661c09ae73eeb9a763f624a079de2ef3f4183061c8cad8ca169e7423bf3c5

  • Size

    864KB

  • MD5

    3014af0f96843daaec1db8cd15f4b072

  • SHA1

    689e81e1cfd9fde05373ba4ed28ecb052ef24019

  • SHA256

    337661c09ae73eeb9a763f624a079de2ef3f4183061c8cad8ca169e7423bf3c5

  • SHA512

    1b3c88a3fbd667acdc0caa66691c6ae85fc378d836aeb644711d2a226e5a8f0f6c1c6fe1156c1317d8e51cd3ba4f01a800728663d8d989570bd6ba7651a068c9

  • SSDEEP

    12288:ZMrjy909B5TJjSzrOGL3ijdVV6C6r3HojiVMTNBNgqSO5HDQwNVSIO:Gy2FpS/hLKVVvW3ojFTPNgqN50wrFO

  Score

  10^/10

  redlinemangositodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1