Extracted

Extracted

• • Target

    7d93fc17c6699238382528523dd494ff4175a925855c6d8d7e10c64b9ce2d025

  • Size

    686KB

  • MD5

    f0ccee12b50404dcd2100c5cc058af85

  • SHA1

    c7058da805b56b194f5f5261ac2f4ff28f031270

  • SHA256

    7d93fc17c6699238382528523dd494ff4175a925855c6d8d7e10c64b9ce2d025

  • SHA512

    52cb6778e83e8dde3330799263d94104a286099eee2b19f7706c24aea59eedf4a0724feacc6ce56884edb007934270b7325a997ff599d5b0a3ea22144dfaeaee

  • SSDEEP

    12288:WMrGy90Y/GCBVBZGDke80P0n3Ewx8npkJAvIbfdwTCKSIKl1IvuH/xL:8y7+CHBZkke80PUEweIbiXi+KxL

  Score

  10^/10

  redlinenicesonydiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1