Extracted

Extracted

• • Target

    f9630ad7067c859d4eb3a68bba9d2980445e5953058d52e9e02af7cff7d3d82b

  • Size

    685KB

  • MD5

    b3e8964b60d8face6312ec66c5293598

  • SHA1

    3e8b5cd17124aae3f04f0e78f4f46ad9a46d4190

  • SHA256

    f9630ad7067c859d4eb3a68bba9d2980445e5953058d52e9e02af7cff7d3d82b

  • SHA512

    441d7076ef57d9f8fe3117bc018a3215f9c26f08b8b25ab79248642bea4d50cb21977e6bc85a65243bbcab7ff67960b71733728bda6f2ec71de880046594eda9

  • SSDEEP

    12288:+MrIy90fkjr4MBnstDpo78SfWVn4hOglTd7BquvEy3BDuE:iyaMsVUzWV4ogt1YuvE+5uE

  Score

  10^/10

  redlinenicesonydiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1