Extracted

• • Target

    2829641f8e40f08bea48997b3f3c6f737ecfc5c3737f4ffdf7df8ba3667b40f3

  • Size

    701KB

  • MD5

    22581e2a6375324392b24f36993b57a7

  • SHA1

    078b45eb00c5250da66304fc1ff2ca6fca7f481f

  • SHA256

    2829641f8e40f08bea48997b3f3c6f737ecfc5c3737f4ffdf7df8ba3667b40f3

  • SHA512

    1499044d52b13edc8b17d89d664bdfc5a764c30a6798e149a572e7d074b52033cdca836d1ae3f2cd07f33642b62568ea81a69cc51e0de938da1549e129747306

  • SSDEEP

    12288:OMrXy908sCwiUU1DeUN/yv+snuimeoWlBEzIOTpnSBRvGjyRgoUq+Oy657i:5yDmwegEoWOZRSayCoXFG

  Score

  10^/10

  redlinesonyevasioninfostealerpersistencetrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1