Extracted

Extracted

• • Target

    313b76e0acb17de32d4eaec6332d927eb5afdb068e58c0f972426d52ddc3bfa7

  • Size

    699KB

  • MD5

    19b0f87b079dfaef8f3679fa89dad42d

  • SHA1

    37297cc3c87dca448479440e1e7b98af2dbfcf17

  • SHA256

    313b76e0acb17de32d4eaec6332d927eb5afdb068e58c0f972426d52ddc3bfa7

  • SHA512

    895b617d2fbc3af85c3cad1371a8fa20b0a7ee23fd05b94a2a961a499ea58f53dacc68075e747db1ae2176b6fee4305d3e9c0466f8424818f146ca843c5be3d5

  • SSDEEP

    12288:BMrKy903ex6VS9n6kk6YI7AYq1Fmxueo+IOgZZxX9BRvDkXRYPa0xLd:nyPOS0krPlmW7IOg5X93kYaQ

  Score

  10^/10

  redlinenicesonydiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1