Extracted

Extracted

• • Target

    f01b2106a5bcf2dd0dd5576715db8cbcd8aefbbec3f8a706c099cd35a83f8f7f

  • Size

    687KB

  • MD5

    ca237bff7d10aab910b97e0fb5bf0ac8

  • SHA1

    88679a982a27b50725668f15d654bad831cf7c9a

  • SHA256

    f01b2106a5bcf2dd0dd5576715db8cbcd8aefbbec3f8a706c099cd35a83f8f7f

  • SHA512

    6c202c67e2128c0c912bbcd7eaa79718d21084b6c352c6d0c89c85607625be6b8d7cf5668c8f187c66c78e5528c4859452b20875dce5ba75bc3efeda8b3c18d8

  • SSDEEP

    12288:/Mrgy90SWGEhnqWdwH9SiPRGSXPaMAXtIQ8APQTGnCZ1Xw3fVrFZqG:Py3WdmQiPRJXPlAyQ8AIT+Pb

  Score

  10^/10

  redlinenicesonydiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1