Extracted

Extracted

• • Target

    5627e6b8b5d82eccc45e5c80399823baa8592639b7ec45013abf0284653567cd

  • Size

    700KB

  • MD5

    4501f68734fd2c74213b9f9fbfde2f78

  • SHA1

    f1a4a18b887ddcb31c6fd0226fe5c3e9980b11ed

  • SHA256

    5627e6b8b5d82eccc45e5c80399823baa8592639b7ec45013abf0284653567cd

  • SHA512

    c866cc26c5fd935a8166cd78b103892681a5445dd36c221fa0ab27d46bcda197c4dc4fd5b24c2786aa63c52ff884c54ec620643f81293c99431dd795b5645f2c

  • SSDEEP

    12288:XMrVy90Ow1l6EJbFvSy0vdGAbqG2Oa3uKvESOVGeqTfBRvg/HJDp1moV3a:Cyp4oExFvSy0UyT2OspYqTfMv53lV3a

  Score

  10^/10

  redlinenicesonydiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1