Extracted

• • Target

    dfb36492cbed8accfd567723420fee4e8c9cdf55de5fa5c32dafb32612cadd01

  • Size

    700KB

  • MD5

    8543c0aac5a524ea3bf50e9c79f139e6

  • SHA1

    e6f0401d292fa024230932005ca81ed671e2312d

  • SHA256

    dfb36492cbed8accfd567723420fee4e8c9cdf55de5fa5c32dafb32612cadd01

  • SHA512

    8cbf903872817763397789f0360a35b4cdbe00b3f7c751d357380cebb0676a85e256bcdea374436ca5d0f6d7a3bec93dc250903a911bbca6945598759149e411

  • SSDEEP

    12288:+Mr7y90VUqRCdtyzwft90RJWAA9qWjSF7FhKx5iQ3QyFcewYBRvLQ6GS6x:tyAUqRDzwVaXkXSBiLi6QHYXRux

  Score

  10^/10

  redlinesonyevasioninfostealerpersistencetrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1