Extracted

Extracted

• • Target

    a0dc6768e8543ec553819e4c8e3bedea847764c36889efa4adc747be2f755f57.exe

  • Size

    927KB

  • MD5

    be75c1da479fdff5d293e6c822bb0c8f

  • SHA1

    e412264e6cc0e8e4f512779bedf0b9e6d7a2e1bb

  • SHA256

    a0dc6768e8543ec553819e4c8e3bedea847764c36889efa4adc747be2f755f57

  • SHA512

    4a19bca52a81531cfef9ee536de64dd96aaa07da72e4712870e8e02c40ab8ff06c8d4474213e9178285688f50cc79d7155836e0aefe19ac92143d9d10b919821

  • SSDEEP

    24576:gy/Bno74xTL+rLzlGruNlcCFYDN9CtEtf:nFy3lGStFQCyt

  Score

  10^/10

  redlinedeziknormevasioninfostealerpersistencetrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2