Extracted

Extracted

• • Target

    7a2eed1757a60174c3bffbdac6980fd2471feb4ef8ea8bd8673ff06f65d4c3b5

  • Size

    700KB

  • MD5

    0d1457b62e573fc100c4697245f8aa26

  • SHA1

    951c15d415d4415a20a409c2df3f6f2eace2c7a8

  • SHA256

    7a2eed1757a60174c3bffbdac6980fd2471feb4ef8ea8bd8673ff06f65d4c3b5

  • SHA512

    68d74b5fb267f1733962eb3a18a7f96767b2fe0b91d6a7f9e29cdab9eaa22e275b7be03742c0328fbed3ec9978c1c1abddf1792235e5295acd891af42bac5303

  • SSDEEP

    12288:JMrHy90HWWvsIh6HcBbrQTj0Fo4rGSui7idVrNBRvhGcXRWNB4jUN3Hngu8:uy0/vv68BATj0e4rG+0VrNc6kNBhFn2

  Score

  10^/10

  redlinenicesonydiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1