Extracted

• • Target

    bbb990023ae2222eca1c0dde10b916ab1079e89634681546a3351821c0353741

  • Size

    875KB

  • MD5

    34df3b34ca269169ab45969d37d2bb41

  • SHA1

    c38af40a551aa77493785711fc8b259ba1461991

  • SHA256

    bbb990023ae2222eca1c0dde10b916ab1079e89634681546a3351821c0353741

  • SHA512

    1131b8c96dd2f03046680ff34a11ca7f89dc274f65340c7c88f8f71edf68f5e1a1ad4fcb967bde59a53e1118343b299db8172e6c2a1605edb6c41d85928f6e59

  • SSDEEP

    12288:PMrxy90J+U5Ly76h3lP573nscdjdCfwBc6tgzzprU4jXSPaShGSAxbX+qVjVO/DT:Cy05Ly761l5g8jdCKCG4ePaXS94hObT

  Score

  10^/10

  redlinemangoevasioninfostealerpersistencetrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1