Extracted

Extracted

• • Target

    96967a4221142488b3ee4bd06b2adbd16782ffa466f9732a240ef246f40101bf

  • Size

    792KB

  • MD5

    ec6f94af241a9a9b582872e37202c676

  • SHA1

    4b6c7c17ac8d5e0614388159b315c4a5ce2d7392

  • SHA256

    96967a4221142488b3ee4bd06b2adbd16782ffa466f9732a240ef246f40101bf

  • SHA512

    72f1a2eb3dac4b1485ce7fb21555a36d6b9a7af88efbba50fd9f70ee15fcc7e99f6851dff412f3fed3b65c8916cd00b68a2c91d2a0644b2d2d3b359c4c01f81c

  • SSDEEP

    24576:myQVf0rsoE2bHIA01Uox14Rk44sOYrCyPO:1Q10woEGu1UeORCsOOP

  Score

  10^/10

  redlinelabamangodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1