Extracted

Extracted

• • Target

    17b2bad302d53ba221343020c33083798a5951cee906e201ecd849fc13da4cee

  • Size

    685KB

  • MD5

    1997fdc45a4bc939df03dae80e794462

  • SHA1

    26ebfebacd4e81ba9eee827b37ded1caf0bbaba9

  • SHA256

    17b2bad302d53ba221343020c33083798a5951cee906e201ecd849fc13da4cee

  • SHA512

    4d70f5108ba1d0263f956c3b7f81e6031449fce482107f8ad22872fccd1db299c54231e4543d661fac6086d4175e25b46dac3cb4ba889318e81b16f4588386f1

  • SSDEEP

    12288:VMryy90NeWIT2FFnoh+BlNoop8SsWSJ4tNexF7Bud6EJXnOzlCISX2:3yjUFo4BlNjoWSafAUd6EhOzYIj

  Score

  10^/10

  redlinenicesonydiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1