Extracted

Extracted

• • Target

    e552563110c3c5022eb5dadf84a5bcad2250b619beebc3bb4b837569b6059501

  • Size

    701KB

  • MD5

    6bc6e4675c1a34e7e9a031d2fe088a80

  • SHA1

    e656fe8c96812cfb45f8af313b4c0c5477e8ea8e

  • SHA256

    e552563110c3c5022eb5dadf84a5bcad2250b619beebc3bb4b837569b6059501

  • SHA512

    a439c31a8b23dc1353bd28cb3247ad5fea71c08d64f7c0559220055f689831f96db05d1c3f1c3d2f43f50f24afd3755c077be9ce7b7e0ecbe8f2f038c9d3ef14

  • SSDEEP

    12288:XMrHy90er+k9I1+Z5phNXgKp4YRuRsFN5+/4RU1EPfUkBRv8+xLN+N:UyDbZXgKp4L8XR5Mk4i4

  Score

  10^/10

  redlinenicesonydiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1