Extracted

• • Target

    45e72fa68831c41f1a7a5edf32bacd2221e69979213b6ea0f6537c0f941e6f22

  • Size

    700KB

  • MD5

    913c44c77c9bc83b7faba6334e5d2c66

  • SHA1

    dd3b6f32bd43a865ce18665efe9c26f81d70b5e3

  • SHA256

    45e72fa68831c41f1a7a5edf32bacd2221e69979213b6ea0f6537c0f941e6f22

  • SHA512

    7c3446a3c2b98918ee71aa4fba297cce0f05b036107e963e10348cba4d1483f0155a68b825f209be32596f365c7a0fcbdff9e13623e4ec0be2e69793ae8851a0

  • SSDEEP

    12288:WMrHy90yP75gFPq63LyDpeXA/qaeeXsuj/IL83EIMHjTBRvJ7GcEh0hRNH:xy95eFDXWftgL80xjT3dhRNH

  Score

  10^/10

  redlinesonyevasioninfostealerpersistencetrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1