Extracted

Extracted

• • Target

    c09b1574295936f6e63f3e604ef58791a208ba3035d7f825736da1fc0a592df7

  • Size

    685KB

  • MD5

    b7f5f4da82f2a32a1e717b9c9690f5c0

  • SHA1

    2fdf48f06b7bc0b8e501e564764d60095a7cc529

  • SHA256

    c09b1574295936f6e63f3e604ef58791a208ba3035d7f825736da1fc0a592df7

  • SHA512

    d8817bf3fdb2bf3b22817def47f27a60a83db524c816b1d69f9c3b113409a31e26e8c7b29abd03a609846d7bad050f0799c0e3040d1a029de70d251d4286127a

  • SSDEEP

    12288:wMriy90NNyqPPsYAs/tg1zDLRHSYjfj7BAkaE6GSg2dbOUJ:CyYRkYLg1zDpFvykaE6ldbO2

  Score

  10^/10

  redlinenicesonydiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1