Extracted

Extracted

• • Target

    b23e2f12110f4b378df1db1e7401d65559446dd79ca3af6b6a868e417ec6c5c6

  • Size

    685KB

  • MD5

    5722cb13eeba555e563e96cf9f16d734

  • SHA1

    ced6f19b776c3fc3dea5872128e9061f9d9a3622

  • SHA256

    b23e2f12110f4b378df1db1e7401d65559446dd79ca3af6b6a868e417ec6c5c6

  • SHA512

    954be31e04ac3c9e276a22367ad08ad166dd84f2d1759384d1b5a75503a1091768b3b5ec81d10b800e4822351cb1917a0aed196c99357ee92a80b58f2cbd3e8a

  • SSDEEP

    12288:LMrOy90l3Tzk45HUVWkYrBnSj0OLzjonFIkEJG2PYBHCNE4HQJNp8d:NyA3TzkG0VWkYrBn1WzjuSkfllCNE4wy

  Score

  10^/10

  redlinenicesonydiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1