Extracted

• • Target

    f41eb2f53756358db0606910061cffa634948e46daff6e86d8b4f1c4ca248a93

  • Size

    700KB

  • MD5

    ebe1290b972cdfce648b71fa7d56ecea

  • SHA1

    754e044666231396ff2f8ebff1036615cee49302

  • SHA256

    f41eb2f53756358db0606910061cffa634948e46daff6e86d8b4f1c4ca248a93

  • SHA512

    94f7d207568a7f523359b94598c704c8e411dff81a018cc16daf2df5a89fe5cfd5866ce6fc04191294c496db890ff7b3b6805c003dbcc2ec5c6e4b0a1b680d7c

  • SSDEEP

    12288:5Mrxy90/m9hYn59sj7jQnUArqbXXJvI0vkywAyBRv1ZG8YExgWt0:IyW9aYUasv9cAyxA8YEdt0

  Score

  10^/10

  redlinesonyevasioninfostealerpersistencetrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1