Extracted

Extracted

• • Target

    be73e3d2d9c2d1b706ba3e3742f7f09f8ecf23439f6547572b48c1f91c27d9be

  • Size

    685KB

  • MD5

    e19eb711c09e440148c1f53121acd2ea

  • SHA1

    b85ce081af6bb5b074d46519c2d4d78d7f3a4732

  • SHA256

    be73e3d2d9c2d1b706ba3e3742f7f09f8ecf23439f6547572b48c1f91c27d9be

  • SHA512

    c2935b000bd8fe0ad21d0b3e0c0c6ae3db0e55c08d9b695f723e264355e568b87fc72bc243e6aa939c584b48692992a8e54957805d282ba2b1e0b00c66d80917

  • SSDEEP

    12288:EMrwy90XQiOF5sLvdE0MZgVPGwkbsdUzjo/Iwcw439RSB/AHEx/3DEZ/:UyZibLVnMiGwbUzjFr29AHEx7W/

  Score

  10^/10

  redlinenicesonydiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1