Extracted

Extracted

• • Target

    ccfada537e712ca1015d89d184790f79724647ebe703fe311373afdcb66fa50f

  • Size

    685KB

  • MD5

    a6bf1cf519b195f78832f04b97f3468f

  • SHA1

    0bb5cc3cd94195364feb18ea8af9c371ed6c496d

  • SHA256

    ccfada537e712ca1015d89d184790f79724647ebe703fe311373afdcb66fa50f

  • SHA512

    3467c8e859cd33a40f1866ceed36ac45e366a0c3cdbeddde642dd2a09714ef032da1baa9272e452f7ee1b8e72116a6a87617fd56434498f63127439be92cc1d0

  • SSDEEP

    12288:QMrcy90OxSL5m1PJcUdR0DKwJ/key0fNL3vGnK+/pzkxJv7BayAEis44zcKJ:cyY0ZJcaR+Kwbyi3WIFIyAEisbwKJ

  Score

  10^/10

  redlinenicesonydiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1