Extracted

Extracted

• • Target

    1b43c24c46a6f942102bed02013e70dd36c0c2e850959fee804fea11e934bfd2

  • Size

    687KB

  • MD5

    df7ca19e6895e606ea1a943d59a7d976

  • SHA1

    8661b451c4731709d8cae1635f2175ed06702523

  • SHA256

    1b43c24c46a6f942102bed02013e70dd36c0c2e850959fee804fea11e934bfd2

  • SHA512

    daafea9d00fab0200a0367b63828f6802df2ddd79414c73873cf5db4636dc47002cb62e32754a9d451462c25627a7fbe711fdb39ad06d7bf3f0e4530f7f05c46

  • SSDEEP

    12288:/MrJy90/XMFz2eCx0Q6jjqj2xXGXbOSpMwqeZ4fZpf9dUPKEv/:iyS+GxXijl2XbOSpMeOfZpLUP9v/

  Score

  10^/10

  redlinenicesonydiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1