Extracted

Extracted

• • Target

    f372a5008a1f411c4a099e00d5188f818d1f0f7e2331fa127c22e6c4d1910d6e

  • Size

    685KB

  • MD5

    dd6ec7dae6f6a36ef15897e4c183430c

  • SHA1

    1a8757e873e8b09254b32dc886a010a06173fa2e

  • SHA256

    f372a5008a1f411c4a099e00d5188f818d1f0f7e2331fa127c22e6c4d1910d6e

  • SHA512

    c8cc7baa686cf3f68bc4a10cd0e940938c4c6a4dc27be26b62347935d344b92c7eb7836c7bcbd83ecb1cd7d29db304eb35968e0281c84ee5a074bf412e6619de

  • SSDEEP

    12288:NMr0y90R5Vt2bZrQ9u0qP+cxFvlx+6pSU4mFjfTiszDLj6DthtGn4LRqBtP4EE3/:Jy479u0qWAlo6pSUvlBzDHqthS44vP4R

  Score

  10^/10

  redlinenicesonydiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1