Extracted

Extracted

• • Target

    0ecde6058d2b547403884d58cbd295e3f887024bf34def529b8ba5b1d9891bb7

  • Size

    685KB

  • MD5

    02066f65e90b84b01491f2bcdc4d729e

  • SHA1

    a45882589436d23560db3159f23a11f129b235d7

  • SHA256

    0ecde6058d2b547403884d58cbd295e3f887024bf34def529b8ba5b1d9891bb7

  • SHA512

    37a4415639403c815799b015490b9616db652ef792a79d21341a2543d723f9d24819fa4a301ffaa656a6af1dbcf06055c371350e2860548072dfacfaad212a07

  • SSDEEP

    12288:QMriy9081BKPBSIExJ0WX7Af1zcBnKwEGIALtsgP:iyjmPBSmWX7Af2FKwEbE

  Score

  10^/10

  redlinenicesonydiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1