Extracted

• • Target

    4ab33171e879286a86e6f49c033eb5da40804f4367aab289001700e0b5e3d8fc

  • Size

    699KB

  • MD5

    a36ff117a56188f9745a72c4d82a6e6e

  • SHA1

    d9400285c5e6518829d7139f2dfa709276448f7c

  • SHA256

    4ab33171e879286a86e6f49c033eb5da40804f4367aab289001700e0b5e3d8fc

  • SHA512

    441d1a8f40bd30049afe17c5f035d3c6bbb25a7d03f363a71ce77747607747c7fcac9618c82d735d247ed927dbc22746ca0331b397f96be33b93e7c1fba1881e

  • SSDEEP

    12288:5MrKy90+ZkOD0uAVqB04TurKVGE3hpqBRvMKphSOdB8Fe:HyL4ucsjpVzRpqIKpjKE

  Score

  10^/10

  redlinesonyevasioninfostealerpersistencetrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1