Extracted

Extracted

• • Target

    fed20c7e366733c624808d68518ab7eac3d80d6d6708c01b184277daf6b27291

  • Size

    682KB

  • MD5

    3ecc5c19f0cbbaec1412fa4d8022f9c6

  • SHA1

    001108ad0332beaa5c60c9a937c6ea78a352b347

  • SHA256

    fed20c7e366733c624808d68518ab7eac3d80d6d6708c01b184277daf6b27291

  • SHA512

    d5f9e6a7e5ca840350e0d8683b4c5c97caa6d4570fc08dba6e71c74c0acfda5437c0bf9e28c75283f058bb02d4bb37e680a59f400ab5dcf7930344ad951a67fb

  • SSDEEP

    12288:aK7KRc/2qg5H3fNrHqZ99foYUtoBsaUleNc8EfSzAON8ymWJtMsOYyBu:9mI2tH3fBHqZnfoYUt4rUleNECGy54bB

  Score

  10^/10

  redlinenicesonydiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1