Extracted

Extracted

• • Target

    f3eaae38db2861e74e8e34e4d008b63543193aea3ead2fe3796d125146b25b7c

  • Size

    680KB

  • MD5

    ab1b5f2489678f478b988fe0721f0e45

  • SHA1

    c8286285a08b69b6cd9642751b8f417c1e20ad23

  • SHA256

    f3eaae38db2861e74e8e34e4d008b63543193aea3ead2fe3796d125146b25b7c

  • SHA512

    52b33c7a12e65bf9a673af11239d33d95c7f67d8c7972c9220e75276333cda8c436ebe6cd27a60f457496782bdfec3d1c261db3f51b417bb534315b18faac288

  • SSDEEP

    12288:y6gKv6OXMd+PoUzOyWIuQ9QkYro8uiQhAfwpCQvoWevi7XxCkI0uob/:d5VX3PnrKkYPuphAYsQ1t7XxtIw/

  Score

  10^/10

  redlinenicesonydiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1