Extracted

Extracted

• • Target

    79cf3f1e82ed180f0b13c72c120078a2c402e176416ffc93bf41e765589ecb24

  • Size

    685KB

  • MD5

    725cce41eb23b630acd2d5df8ee29464

  • SHA1

    3ef52755e80de477fbe48e480acf7c1d4fb56f1c

  • SHA256

    79cf3f1e82ed180f0b13c72c120078a2c402e176416ffc93bf41e765589ecb24

  • SHA512

    d32f5ac1fe37585806c0693abc9a72c2b369b0f4e361f5c2f1265e4dbc1c5a636ce904d6399288e71e2ce4bd65194309c2e3ea3ed1e680bf000ecfc28f619ce2

  • SSDEEP

    12288:/Mr9y907LVaetQlvDiveovHPxR1pLzTHVd3qv4loBlyIIBr65ES244zJ:uy2VGlvAxRfzTn6vPzyh65ES2bd

  Score

  10^/10

  redlinenicesonydiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1