Extracted

Extracted

• • Target

    29778bde64c7b2ccbf3a15f90ac46c9f15a47407decf6220f5e1a169d6ae56e6

  • Size

    894KB

  • MD5

    d8c034d277c985b3b74c826b0b30a038

  • SHA1

    b2022a911672a92e82f2b25835edd3d8caf271df

  • SHA256

    29778bde64c7b2ccbf3a15f90ac46c9f15a47407decf6220f5e1a169d6ae56e6

  • SHA512

    18222b90d06c02f0390b46abb5270df47428dfc4d82ee044e2003a953831233e36440ac2c054c0c4efcb280518db5883d538255409820d4abd8079c375d4d3b7

  • SSDEEP

    24576:yylcplLnqZe2IDSgdiONZDvayatsmisXU:ZlcDB2ktdbZD5aqm

  Score

  10^/10

  redlinemangositodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1