Extracted

Extracted

• • Target

    4fccee03affa94ba26f6905c96dddd6ec751c34426ada626a64a5eab18db2566

  • Size

    861KB

  • MD5

    1428a87768b389ed2e30b80b190a26ef

  • SHA1

    64a92416c249dc72e54ec8a8df6eebc553a59a5f

  • SHA256

    4fccee03affa94ba26f6905c96dddd6ec751c34426ada626a64a5eab18db2566

  • SHA512

    f54bf6274adb5477c8eccfcc0bc218600396aee1ee1e54098d1c9d35eb4b430d2717514f9ac8cfd5a1612af777870a18825308a970e1088f7aff334f36e4b2d5

  • SSDEEP

    24576:ByEJrIahyoIQEnhqxwAu8TCRDaoZ9zcsJmO:0qjbgA8DLzc+

  Score

  10^/10

  redlinelabamangodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1