Extracted

Extracted

• • Target

    654803ec98ad3dcd4747eed16476bf578c24cac2a481e1f2fb30611a75af2235

  • Size

    894KB

  • MD5

    124a69c1292c970f28caf85448d22c80

  • SHA1

    123bddd2f42404cb54cf1c570b737459848d8d98

  • SHA256

    654803ec98ad3dcd4747eed16476bf578c24cac2a481e1f2fb30611a75af2235

  • SHA512

    88856c1f72515dfd5c4e9eec34230b65bd31e12a0a8d7309d6b08854728113bf9eb2870ac0d03aea926a14f9d2c57f5f431fc059ad52b05b14564d13351c2549

  • SSDEEP

    24576:/yZ8uM9kdzprnSz8icC+j9dqmIataE1r:KCFKBV+c9pIaJ1

  Score

  10^/10

  redlinemangositodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1