Extracted

Extracted

• • Target

    ffbd9b01e5fa35d283f1839e22b59332eff62e8dfda8b93cdfdd41e54e5b4b17

  • Size

    685KB

  • MD5

    ced5a33995353bf952bf75ba999c3dbd

  • SHA1

    281d0c51f5e8b0000726f151410a6044652dd785

  • SHA256

    ffbd9b01e5fa35d283f1839e22b59332eff62e8dfda8b93cdfdd41e54e5b4b17

  • SHA512

    e41c4aecc72941aaa4777fb2fa26185686a05caf7a1efc20fb2bd52b10787bede2f2d678c691d8b85c5665fd10997e85b754ed36f648f840c2af7ea281a3a9fd

  • SSDEEP

    12288:YMrWy90A6ON9DVb4GUdYe6bYPWsQ8BCDZScDZVdlC7PR7BgVDEGWZlHuNsPW3zgw:OyJVK1YJbsWHZdScDZVXCzJSVDEHP2n

  Score

  10^/10

  redlinenicesonydiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1