Extracted

Extracted

• • Target

    800c36b2d869324426f6fb4d8ed085876f2e30e94bc5a5c3e04b01c3d6a87920

  • Size

    685KB

  • MD5

    f82eda0f3e5d9bfcb80ff1ab992f50c5

  • SHA1

    22a3a350216a5482fa0a19f541bf341eec7870e1

  • SHA256

    800c36b2d869324426f6fb4d8ed085876f2e30e94bc5a5c3e04b01c3d6a87920

  • SHA512

    bcbe050dc98b042b7546b14c144ec71e9cefa5dd068f7438de0f10a490d14d70ec7bd1a77b2eb4138113d5883a246cc922cbf7d3a4f1542cef31bdcd8197e010

  • SSDEEP

    12288:/Mriy90k6J3v+DUXERhbEXJAkc3lqSL3v8nRRNAglWqlB0arE0XThDxAA:NyCf+wXERh4XOd3UFH7OarEEhD

  Score

  10^/10

  redlinenicesonydiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1