Extracted

Extracted

• • Target

    60f45d8ab33b1be493595bb5fb01623931df78dd791fa49dfc434b4f653fedef

  • Size

    686KB

  • MD5

    f9c1d31447ab86ccee167fed18f59f47

  • SHA1

    6fc3e641453ef21be6b1b45eaa5637b5eb650022

  • SHA256

    60f45d8ab33b1be493595bb5fb01623931df78dd791fa49dfc434b4f653fedef

  • SHA512

    61d6fe77ffda97e307c626e13137a6c1f886ca75db102bca399897b319e0c0b7680de136f59324f1ee4417101e244e77e7148f653567120cc7ea6d262eff9107

  • SSDEEP

    12288:/Mr3y90DJOVNaqQgKScO8VSJpYTWGlq8SV7FC3ZIE5Xe+1diij:wyoJOVNaxgTcOGaKTWWqZGZp1di0

  Score

  10^/10

  redlinenicesonydiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1