Extracted

• • Target

    7b401e0b65ae467342b6f6056b028c1e0d74913319bc9e4b89c054136e309afe

  • Size

    700KB

  • MD5

    4556d41e49cc3d6872d2b98e83966aec

  • SHA1

    2d4daa02654f8acb9b42f465ea07b304d9c7d96c

  • SHA256

    7b401e0b65ae467342b6f6056b028c1e0d74913319bc9e4b89c054136e309afe

  • SHA512

    d3192d00f4e54afb48cf9e9a512f7f60aa755bc4d8462dbef69ece72b741c66bdff04f471a175aa616e6441e7384124d401b72f6720d9bb63e65b0e70c9d1dbb

  • SSDEEP

    12288:xMr0y90mqPqTkTx87o+cE+yC538GGc8LZuVWu+McU+d4uKwBRv3G+u+aHN8kBAp6:dy7O+cfhxG7ZM5S4uKwfayKW6

  Score

  10^/10

  redlinesonyevasioninfostealerpersistencetrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1