Extracted

Extracted

• • Target

    836c94243ef52ba133f26223a49c35d61ee4e28833568c47b1ef5051d5561323

  • Size

    685KB

  • MD5

    c7118b63ec3dc9d927ebeedf8dc6ee51

  • SHA1

    c1e9b3f89b7930d7ce90e19f30932ecbae3544af

  • SHA256

    836c94243ef52ba133f26223a49c35d61ee4e28833568c47b1ef5051d5561323

  • SHA512

    baf03d5d801ce1105864106ec63f4670ce395afb6d1f5cfaa3c1bf5d132baa94f2c842a79bc1dec003307194e614cb59ccf8c454cf181fe998ca55b66be81564

  • SSDEEP

    12288:vMrRy90kGJhSLQIH7W9g3cuePV7lAVoJ8SkWwD4vxKh7BwaTEes41BX9d:yyoJsD75f27lAywWwEvxmiaTEeL

  Score

  10^/10

  redlinenicesonydiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1