Extracted

• • Target

    b96a83fe60adb91d1721e515fdb7a5ab6aad4a97796b63fc07ef562b96428ac2

  • Size

    700KB

  • MD5

    d8022a82d5faa46514db9db85967e05f

  • SHA1

    bc7c1e94e9a152f3f12c7165c59028bc3b9af033

  • SHA256

    b96a83fe60adb91d1721e515fdb7a5ab6aad4a97796b63fc07ef562b96428ac2

  • SHA512

    2f27b9a76e5705ca222faf7006a0eb0074903e3f73d28fa8f47f302a39a987353278acb2f1e846a6d5742c69659a699fa291b6c20414c3f2bf943b1f002fe70e

  • SSDEEP

    12288:dMrBy90Kk1SnzA8X5LV7g6VxhDSfjk0NANbfNBRvINllOvrGH3bx5:kyC1uzAkZZGfjklfNUjlOvrGrz

  Score

  10^/10

  redlinesonyevasioninfostealerpersistencetrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1