Extracted

Extracted

• • Target

    f71f53e12ec7ff3bb4f3c3dbd88e0e4c8fbde5419a9cae7f141efb0b6523fd94

  • Size

    1.0MB

  • MD5

    4e26b1c571e5577a06cb8f3722a2bc69

  • SHA1

    38dfebcbfbc49019af5f9f619763d1cdc8c53b17

  • SHA256

    f71f53e12ec7ff3bb4f3c3dbd88e0e4c8fbde5419a9cae7f141efb0b6523fd94

  • SHA512

    db787c8e5de00a0b497552101a232bef34d53707ba606c57b29f958e25d1ffbaf2a902bf4c9d2a8166ba900d80627c945ecafdc7cdc5b9d0e3cfc222b4a99070

  • SSDEEP

    24576:Ry+udmt+al4A+Gfn1a9FNG8U44Trm71cpFgmPW7G:E+ug4am1Gfn1GTG8UKqc

  Score

  10^/10

  redlinedisaladaevasioninfostealerpersistencetrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1