Extracted

Extracted

• • Target

    50744c2293052e8bcedf1b309a2bf66ac1d3dbc8f0cc8bfe98e277ff6f122573

  • Size

    700KB

  • MD5

    5f3968b74f43367f85137f48fd256cbe

  • SHA1

    f6314642c3f0315d7a049bbf6ab28cbf43311cbf

  • SHA256

    50744c2293052e8bcedf1b309a2bf66ac1d3dbc8f0cc8bfe98e277ff6f122573

  • SHA512

    71709c3eb06700ad6f4bd95c8e2ee509bf1aabc05b89ac7bdd596998ed7ef84b8f958b018b50bf79e8a6e7efb1ee821991833d2d4903e86c2499638751b6f296

  • SSDEEP

    12288:zMrly90ZTpmix/jwRnAVqNUDrej4NWdSHCllVBRvHIgD0gHjZt8Y+q:CyeTpj/cZs7XejFUHclVTbYq

  Score

  10^/10

  redlinenicesonydiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1