Extracted

Extracted

• • Target

    7be4862fd2540d732f0c00085659c784dcfb37ba1bc6f0de03bd63cdc5486816

  • Size

    685KB

  • MD5

    a8ee9a1502b7e2288c59d86a5d9d4680

  • SHA1

    84802cbc0e660db6a199359876fcafe5f12e46a4

  • SHA256

    7be4862fd2540d732f0c00085659c784dcfb37ba1bc6f0de03bd63cdc5486816

  • SHA512

    1beeb40af2cd15b53958b9fe1258b8b2ef126303211b760772071647e7718a49768c033b71125b7c2998ae643bd1215dd0c9471e46aaceea0c1ed78f50fcea69

  • SSDEEP

    12288:qMrMy90eRis6wMJwnRbrO6SJnkyHiNF/jUHGsG/75mB6WtE15k01mfdbDb0:KyIs1MJiSNwzR/7goWtE15kT1X4

  Score

  10^/10

  redlinenicesonydiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1