Extracted

Extracted

• • Target

    b1b211f15932778da3d44e00936a2a55c87f0ed7f6444dc2a3cee3e6f84dd9a2

  • Size

    686KB

  • MD5

    f7c0c65882bc4882472f910a9a868f7d

  • SHA1

    60e9855e71230733192c6a0692405431fdc56000

  • SHA256

    b1b211f15932778da3d44e00936a2a55c87f0ed7f6444dc2a3cee3e6f84dd9a2

  • SHA512

    9c8d7d0915f24606aae580b4c7b9c2145ec54adbb744b66c4aa6206ca3126682522b3da5520287cad03cecb8da46a1ca3dfb6a66233a5c4ee6b22f417fd3a7e9

  • SSDEEP

    12288:dMrBy905hN1qSFu7pCCnXA+eWqTdDcfwFtqZObxmEMqRGXQs:kyeNkRCCnQ5zo9K2B

  Score

  10^/10

  redlinenicesonydiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1