Extracted

Extracted

• • Target

    71d4ce07babc7d16d753b5bd31ce33b3d333712838618ad900beb7c4d623e0e8

  • Size

    680KB

  • MD5

    32db06c269f153f472f7774370ae81d1

  • SHA1

    822ea3c82c7a28b00fe079b0c3546a3a2a64c627

  • SHA256

    71d4ce07babc7d16d753b5bd31ce33b3d333712838618ad900beb7c4d623e0e8

  • SHA512

    278cf98e5f297e086414b20100b03d204dad72d160f6f6ea0b2891b539d935e3b265aad8087d01d894b59788e1294e0ab5fe04a416070f0686a42fdddc1e519f

  • SSDEEP

    12288:K6gKv6OXMd+PoUzOyWIuQ9QkYro8uiQhAfwpCQvoWevi7XxCkI0uob/:F5VX3PnrKkYPuphAYsQ1t7XxtIw/

  Score

  10^/10

  redlinenicesonydiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1