Extracted

Extracted

• • Target

    36eb7b9ba80adeef9e812b54fb714ee6ae296bdd6d04bdcb9d5224992f15846c

  • Size

    894KB

  • MD5

    9f9ec8c01fa1137050a6e6af6e9cd155

  • SHA1

    8fab5dcb55c226fae1f003d4700e9605015686bf

  • SHA256

    36eb7b9ba80adeef9e812b54fb714ee6ae296bdd6d04bdcb9d5224992f15846c

  • SHA512

    ab501a64667015c29d31ecb349dbf87cb85d74dc7bdee39b615d78ba7d1250f8bf65c1ab8f3f53f20fdd2935e8b5af922dbae4e4fbc3c0f34fb8190f9747c2ea

  • SSDEEP

    12288:ZMrGy90iw64bpGntsco4kibkPGzrWts+pqRJ/+anpMV+VUdRIXDZHFCP5daXD5Y1:jyBXTZo4k4lzB+gRJGG8at+ssTR9

  Score

  10^/10

  redlinemangositodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1