Extracted

Extracted

• • Target

    9256fed9e07c01bdc005dcb9aacb4781951fa4f45314dcbfbcfc319c5563bfea

  • Size

    685KB

  • MD5

    b98cd68eeae51dca96b99b1a26ebae89

  • SHA1

    671b4b1cc0aa34bab81874c39447c6acf6359cad

  • SHA256

    9256fed9e07c01bdc005dcb9aacb4781951fa4f45314dcbfbcfc319c5563bfea

  • SHA512

    16aa7bd36c3de679d7aa92f4afa07bd5ffb8c76fa4ee15e0c2b419e9107dabf2ff769a33ab78e05c7ee82a44d8a2d1ec67d2611a2beb3cbfcb3aa74c19054fa6

  • SSDEEP

    12288:zMrwy90nNHmylnHZaJ3GJBHZZl3QVlE3RGd5kAy7Bs02ECKLJtAPWh5b:XyIHmylnHZQYjl3gORGd2xG02ECKvXhl

  Score

  10^/10

  redlinenicesonydiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1