Extracted

• • Target

    2d97ef5189f9c04df861b3746856e293f96b59f1b6f4b6901735140af66aeff1

  • Size

    699KB

  • MD5

    aeac819d00e1da56cad01200e5d4df0a

  • SHA1

    0c2b466a4bf1f6a94e327b365ddf3c8d3981a81a

  • SHA256

    2d97ef5189f9c04df861b3746856e293f96b59f1b6f4b6901735140af66aeff1

  • SHA512

    f46a26921cd20d65e6cb1c469e64bfa42af0b0b5e3a74430ac435beb0c4d187a0004c4f00260596e16b8d719ee76e87ef959e6014ed1742d910924158e5179c1

  • SSDEEP

    12288:EMrly904MSn6iXzBychHMmXZeUZjukHvYEmXfBRvKw8uY9jj6hX:Ry5nzcchs2ZjZZHvHmXf+9f6hX

  Score

  10^/10

  redlinesonyevasioninfostealerpersistencetrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1