Extracted

Extracted

• • Target

    886d0c2d3cca650cd26bb1752e302d0c05675358c213a0bc1985a8b9a56b52be

  • Size

    700KB

  • MD5

    311c19c2ce42030d816be57d17cf323b

  • SHA1

    ee83b830c1b64ebd6862591ce779973aa75c80dd

  • SHA256

    886d0c2d3cca650cd26bb1752e302d0c05675358c213a0bc1985a8b9a56b52be

  • SHA512

    966509a7ee7c77c41d648f98cec1cd4c025e824e27e12a4fb2d7a2794e4da9992d3c2a0e2956082a0988c913d6cca0395a67d79b83b92e74ffd3daeac4fa50f1

  • SSDEEP

    12288:AMrmy903hjzbEgiuS3wp2YSu26u/1CuZ5BRv7llOr9IBXX37:WyWrEgDY4c/1C45dlOr9IBH37

  Score

  10^/10

  redlinenicesonydiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1