Extracted

Extracted

• • Target

    03d0f4853b3cbd51caed21cd4d869486270ea836a013f6032ef7263d41a3bc2b

  • Size

    861KB

  • MD5

    b60f535525b5d8e6699ea083565b09c6

  • SHA1

    ded078c0e0ac9073772494a908f9b2be3f3118de

  • SHA256

    03d0f4853b3cbd51caed21cd4d869486270ea836a013f6032ef7263d41a3bc2b

  • SHA512

    a2904120ad8f52b0906d943b4bfc9ecaa8ccb421466cf442308f8b4d5ca1211ae871b37cb4ebfee7d0e980cf25af636e0364209eef63320e42b637bd656d5c30

  • SSDEEP

    24576:1ysDmqDPn5AVb2VyKp3RaX7u7nsTmhn9CK:QsiqDn5o2VT3Rai8mhE

  Score

  10^/10

  redlinelabamangodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1