Extracted

Extracted

• • Target

    4dbcfc0d5fd342a04468a08cd3a8b8f3b8326a891d7573503d8bb1c02f557066

  • Size

    685KB

  • MD5

    17fa825648372b80bfd8390c8820eaa3

  • SHA1

    c1fe513cd5d21b0da758f005e12633a2f8771a42

  • SHA256

    4dbcfc0d5fd342a04468a08cd3a8b8f3b8326a891d7573503d8bb1c02f557066

  • SHA512

    8e37ed1bfe5428015783508df849b1de20ce4ceb7514a9ce9b82f8ff78c425bd0dd7437f676ef62964df3b96db9377ac25704c552ba6141a34e2bfa25a5b02df

  • SSDEEP

    12288:hMrEy90OLrG4PpYYkJ0kf4jzL3vbn/QSPNJb+wGLBSqLEb3hNNilGbU0:1yhvGaYpN4j3jIjAqLEb7r

  Score

  10^/10

  redlinenicesonydiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1