Extracted

Extracted

• • Target

    1ac0f1c6014e3d619703681561b0146939956c69cc3832db46af30a94aa116ba

  • Size

    684KB

  • MD5

    0d3d08f4d9e293f446ae0cc9f0155345

  • SHA1

    3181f6e8be77ec9a03e5b026535f7e3259c53956

  • SHA256

    1ac0f1c6014e3d619703681561b0146939956c69cc3832db46af30a94aa116ba

  • SHA512

    a71f757ee6a2a567c932a06eaac3d82362f17c583195ad625aa9ae0f72aa81a2ba90aab2aed85dab4de0132b26e75e09e387c46da8b5d71d9fc74cf28b463dea

  • SSDEEP

    12288:SMrFy90gGokrY6MN05CAYJBkouA391aSLdvi2THJgmwBiJfEAGI23trV:LyTLsLYduyPdq2lIQJfEAQ3th

  Score

  10^/10

  redlinenicesonydiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1