Extracted

• • Target

    a5f6644725ae63a0f10a62592c3ff572ab70b999146b65fbf4ec360985744b8e

  • Size

    696KB

  • MD5

    0cf2feffdfed291876c5ca2f9c82f3b7

  • SHA1

    cd6d020449c0cc1a5110ff5d02f7c1f0fd0ce7fb

  • SHA256

    a5f6644725ae63a0f10a62592c3ff572ab70b999146b65fbf4ec360985744b8e

  • SHA512

    a3861e5fb15139f09e46176d9b71bf490776d5c15a6e24f7733204355dc62ea07eedf165ddea710440320bfd6e7c6bfc527f7ee565b79696940e6e4ffbe00c57

  • SSDEEP

    12288:nldKvPdNzHuqabPOfG4XRZm/3wjgbhgIRPIKBC3eVe8w:lAt9HuXPYhc/g6hgIZRaeVe8

  Score

  10^/10

  redlinesonyevasioninfostealerpersistencetrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1