Extracted

• • Target

    3eb159040dcf466924fa02081bc21c15440f430fee73420070679bfd4c00809e

  • Size

    700KB

  • MD5

    8107275f79e602e8ec2d756bcfaa5ca0

  • SHA1

    e9392d1e1de343c282445b8aa5741719407ba043

  • SHA256

    3eb159040dcf466924fa02081bc21c15440f430fee73420070679bfd4c00809e

  • SHA512

    75372fc7271e68b7b2a166aef41fd82a36ee3a8f1137c581a368f5e59fb68a831324f95a8867bdf86d89a5585d9c606ef3e9501a2dfe624cf5640385295f84fb

  • SSDEEP

    12288:pMrly90fJm7tpXDG7lOJyUvrSVB3yGQqu5OgYr9fxP3hP2jBRviDNGzSA7H:wyumTzG5IjKB3yGYv2PxP2j2GzLL

  Score

  10^/10

  redlinesonyevasioninfostealerpersistencetrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1