Extracted

• • Target

    79a1defcb6e4fb63439497cfe359fa0b2a186a8959ab325fae91037eb91badf1

  • Size

    700KB

  • MD5

    e2fb1f0fcaba53f260792a2c1fffce1e

  • SHA1

    7e5274b218ca2cbd0ab58365903b1ab7bd37ce2f

  • SHA256

    79a1defcb6e4fb63439497cfe359fa0b2a186a8959ab325fae91037eb91badf1

  • SHA512

    2290c84fa689140458b8bb6f50515a73c07b2f1d5d7b41131ea3cca151adcfbd5fbc95be5f2f3bfedbe0aa19ce92f609e6a09f5cc8e2a91101687949bfc4a4b0

  • SSDEEP

    12288:5MrIy905uSdqJoyFy4hYvwI6aA0qH/GKkvIVSg/2BRvNas10t2jAD:lyloyFnZIJxE/GXvvK2haw0WAD

  Score

  10^/10

  redlinesonyevasioninfostealerpersistencetrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1