Extracted

Extracted

• • Target

    b302aaf478341447ae774d444f96894a67d07d93999bfd086cd997ee0fdefd83

  • Size

    685KB

  • MD5

    a83323dcffde1d56b95d6f7ae8598685

  • SHA1

    a2fc61339e52f82bf7d3e5d8be7abee2463eaada

  • SHA256

    b302aaf478341447ae774d444f96894a67d07d93999bfd086cd997ee0fdefd83

  • SHA512

    f3e888aeb717bee56d66c5b9e213b943d1a27917def1290986bc99f061b02f16699bbbb49c82a72e0c2a9d1e5d5b6166865abb58bddfe89b616ff2a6cae52de1

  • SSDEEP

    12288:7MrPy90iN2JGVPRUxS1YjvS4ksdTcINRc7BEtAEg2Wvp59:EyvN2JEKxS1YjvesTcsKetAEg2O

  Score

  10^/10

  redlinenicesonydiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1