Extracted

Extracted

• • Target

    8bbe1a2d422737d3221a92d79d2ee2491fc1cd23a70a45bbf5b3df1cf4a8f9a1

  • Size

    685KB

  • MD5

    ad15acdf392a4201debebbc63ffe61e7

  • SHA1

    6528da395b830aa2a2d7ebccea63b2c5d20e7497

  • SHA256

    8bbe1a2d422737d3221a92d79d2ee2491fc1cd23a70a45bbf5b3df1cf4a8f9a1

  • SHA512

    83d6bf918dec111dc9bc9fe493f376a2c48692e461d6066462f1560c73354470e2572e75c7fb364da73a28810dba3d042dc114f974cd657971a63367c224a21a

  • SSDEEP

    12288:7MrZy90E/ON35FWiztJOkAYD/W5pN172KBT/WEi7LGWBJd0:Oym35k89W77vd/WEuGWXd0

  Score

  10^/10

  redlinenicesonydiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1