Extracted

• • Target

    010dd137fa007c5ab54a456a6b1b2fa7cefb456d4700e2db974103d4964eb132.bin

  • Size

    555KB

  • MD5

    142abe1fbfbb8ddd3f66c082bc17c4ae

  • SHA1

    871daf143f882d20e98e5ba7b7ada7011d9603e4

  • SHA256

    010dd137fa007c5ab54a456a6b1b2fa7cefb456d4700e2db974103d4964eb132

  • SHA512

    7d2ac2e98bf43ed506f8fb8c07a281960a0126a778a633c1bcc7b91708ace080d0caa5661a64d54e79985f8e59c60e7d9121692af31878a404b936aad6a7c2d8

  • SSDEEP

    12288:uMroy90TwRXGTv9w9z0C+g35g+IN2dUkiL9aZUyDfKEp:Oy7cj9pj+DSn9aZ9yS

  Score

  10^/10

  redlineruzhpeevasioninfostealerpersistencetrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2