Extracted

Extracted

• • Target

    2b52947e907101d5380de55afc9135603d1fe292c683d89f56f606715784844e

  • Size

    685KB

  • MD5

    3615bc16e4cbf04eff35a8930f4c412d

  • SHA1

    5048b1473a47c84d6e304fc838f4abce916f21d5

  • SHA256

    2b52947e907101d5380de55afc9135603d1fe292c683d89f56f606715784844e

  • SHA512

    8cf8f1f02e23c45296c9866317fb1d8f7f03ec329a0273d1939ec2498a90809645aaf332a44989764139014fd86b777913cf14dd1c5841340bc924d15af331b8

  • SSDEEP

    12288:PMrgy90hz5KYdr1uAU9JIkbitz/8ROZ2w4a7f4PnBLlVEGQQAuW9N:7y+TfY949Ia7f4/BlVEYC

  Score

  10^/10

  redlinenicesonydiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1