Extracted

Extracted

• • Target

    db03c3593c531c28762b244ef368d0161a6562737a57082fd581f2a732c25ae5

  • Size

    685KB

  • MD5

    fc477c72a06b30cf225623446e706973

  • SHA1

    3fa4fcb9236f020b6e28e5e81bf9fe65e9eb36ce

  • SHA256

    db03c3593c531c28762b244ef368d0161a6562737a57082fd581f2a732c25ae5

  • SHA512

    bbb73bfc3557f9763b5b2ad50a560e9be7ef345eed1c2b69dda6f90eda671ab0dd5b6b1c0affac11f82df05f90d9a6c139677c2e796f8aa2dc38d6d90a8a4f79

  • SSDEEP

    12288:+MrAy9007wd2LIGoD6A1TEmhkWUJr95YPkzK6FIdGBe3WEVrdxwU6P7ZG:ayfM2xgtcW+r92k26F5E3WEVXug

  Score

  10^/10

  redlinenicesonydiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1