Extracted

Extracted

• • Target

    5bdc17ee9e06c36efdaf48b788180c90201ba8c35589e823ab3a2d0e298e827c

  • Size

    685KB

  • MD5

    f650cfcfd7eb78e8559a58c02a82cd27

  • SHA1

    467bca90ba8486da5b2c7e687863d881d5fd0229

  • SHA256

    5bdc17ee9e06c36efdaf48b788180c90201ba8c35589e823ab3a2d0e298e827c

  • SHA512

    bfcc2b349aab647b5a5164f89b43b6cc7b7dfa42e7dbe7307ce345f030cd19d11b8b2c6b58e4006f3731604b59ded883f9b4f9d181431a143642d907b1bd3b34

  • SSDEEP

    12288:3MrSy90GpymuAtp6i7qv7mL8JSkKrf9PG0L4makxF2BPpSEAUuEQxbwmCPK:RyVt0eeizM0V7YNpSEAJvxbwPK

  Score

  10^/10

  redlinenicesonydiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1