Extracted

Extracted

• • Target

    96423c11ee60508a161c301b8a18a1dbebc243f943f7f50db0a8d8af8e61b18e

  • Size

    793KB

  • MD5

    7bf4dd892b8197264acdbb81dc74cff4

  • SHA1

    c64d3d706f95997ee0e0d1be5253aae3338a46a1

  • SHA256

    96423c11ee60508a161c301b8a18a1dbebc243f943f7f50db0a8d8af8e61b18e

  • SHA512

    56dcd8dca12651d46c8e4e1574e2b0f77917631fc3c7780ea4c26404c11a7a80cd49dc62354f1dc29f844de45db98a49aa1cb4c6b2c84505621bdb0fab6d92c1

  • SSDEEP

    24576:kyzDVzK0ZgYeERQKUsJqivlcDl2I2QvsR:zzDfZO2xpvSYIvs

  Score

  10^/10

  redlinelabamangodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1