Extracted

Extracted

• • Target

    da58ca0265342ac2bc10666d0803771e2751522b1c7bc9cc5ddb3c717105511b

  • Size

    691KB

  • MD5

    89ae8d43eaa724a3cceec8885235f601

  • SHA1

    36be6adad9f7c873e324701f514ec032c0f73346

  • SHA256

    da58ca0265342ac2bc10666d0803771e2751522b1c7bc9cc5ddb3c717105511b

  • SHA512

    349eddfbd5064e183e3a7efecd0b975be547fa522e46c415182915ba86b8aa469eec070f959ca099900ac30fe18382162055f0283e92946f5502a6803623c11d

  • SSDEEP

    12288:ajXKBvlIpVxdoY3596cdUkVcLaKNJbITIIkvg9UnFhsMZx8xT2:0abIpVjtScdfxKT6IIktFhsMgT2

  Score

  10^/10

  redlinenicesonydiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1