Extracted

Extracted

• • Target

    4d47b3a0e03b8ce78ce1905d54e9acbf5ec8ae0ba63a94f917c6334365701fa8

  • Size

    685KB

  • MD5

    3f1f21de2d53faf3baff8014ac49e231

  • SHA1

    b879ef53e95b7695f64baec581da0827e454ab38

  • SHA256

    4d47b3a0e03b8ce78ce1905d54e9acbf5ec8ae0ba63a94f917c6334365701fa8

  • SHA512

    d5660044979ccaec7f8812e5ad9b09ab295d5a698850bc7e831bdf82e63a958b50255e771f49271a84d7bee6b481159141123f0461f0fcc5ad64ef675da44e67

  • SSDEEP

    12288:mMr+y90CpTO4/Lju/ZgL4WYrwoqmiqdK7BubzE8JLA20df/GSo:syxfu/ZgEWSLZi02UbzE84fXo

  Score

  10^/10

  redlinenicesonydiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1