Extracted

Extracted

• • Target

    90b7fa7c886ce65f5e0f5a1146870d579d344a43395a2f0aeae0a7171a6a7443

  • Size

    701KB

  • MD5

    83f9046c39ae2a70e34e8c1654c496b6

  • SHA1

    e44ae86ef34724a8f3bc12c1aa3e59b9861796ad

  • SHA256

    90b7fa7c886ce65f5e0f5a1146870d579d344a43395a2f0aeae0a7171a6a7443

  • SHA512

    97c63551f19e3ed42b7c8a5ac084470a85e814cb0fff32772552387b5daf64ae18fbf6a11d82b838558e3b284dd26556d4cbe929dea84a3f00312573073b0370

  • SSDEEP

    12288:iMrTy90edMaALDAWEvXfCn6zzyDCFCuaDzSm5701vgcBRv7xXEOYMi4:Jyt34MXfCnYzymF9aDz9YNgcPF79i4

  Score

  10^/10

  redlinenicesonydiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1