Extracted

Extracted

• • Target

    22adb04109f931ddb8af780a344ed43cf25ebc13dc5d1fa3d99ebde452845dfd

  • Size

    787KB

  • MD5

    f21a4ead539fa51027e9783e7abd200a

  • SHA1

    65c68c890669cacf9f83ac3639b7f6dbf06960dc

  • SHA256

    22adb04109f931ddb8af780a344ed43cf25ebc13dc5d1fa3d99ebde452845dfd

  • SHA512

    fbd9f95e673d2b686bef41d21dcbd3a99c0b09564d0debc97a9a2e7d548f6852234ef8f40bd4d0c30cd66c3bc69f96b51f93abd5f080ea10701b958d3a772d98

  • SSDEEP

    24576:9ypoYpVKDQFxHs0H2oieK3UPmTm3Q0vX:YhpLglyR

  Score

  10^/10

  redlinemangositodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1