Extracted

Extracted

• • Target

    2752a4e9fb89b4a64945d1d49db29de349596da5001d84ed2a7401c1bde2ccb6

  • Size

    685KB

  • MD5

    c6c905352e36e28fcef37d7b171983ff

  • SHA1

    404a27825c1636eaf9f50ca8456bd0b649f39115

  • SHA256

    2752a4e9fb89b4a64945d1d49db29de349596da5001d84ed2a7401c1bde2ccb6

  • SHA512

    0f0fbf3c44a7f8157cf79aa0df0f0095ed24da4415d8b7af2e3f58ef6edbe1cf39696c5911653bb76634e9355cbef03cb8e274535d237e8e4db8d0c1a7923603

  • SSDEEP

    12288:HMr2y902wCoxVx/EjU3oorHJUkYGJ/jtT1kNrRLXGs7D5BnopEiQ248RuGe3hV3n:ZyTYXBGCP7vvmrRb5795opEo4WuGehVX

  Score

  10^/10

  redlinenicesonydiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1