Extracted

Extracted

• • Target

    2427ecfb2c6af9ad867afdc4f920927664c192717d0a8f31bd78de7fced436b5.bin

  • Size

    1.7MB

  • MD5

    3f2424c5f3370d40f0cbad98144925b7

  • SHA1

    3c8d145cddd12b030382d55b79067f2e6216d18d

  • SHA256

    2427ecfb2c6af9ad867afdc4f920927664c192717d0a8f31bd78de7fced436b5

  • SHA512

    3262bd997494afd8307c50e63bb6bbd0723dd43bd0a998bc55d7e524084afd15c5318ee7946115b019d010b37130e823d03825dfcd477925e122a5b94c272dd9

  • SSDEEP

    24576:xyg0x+Pkpku8zs7quytFJV4b7x+Kt9E7WBqoXXYT1AfdOEEGLufmhGuZ:kgy6Ju8z8qzt/Gco4afdOMufmj

  Score

  10^/10

  redlinegenamostevasioninfostealerpersistencetrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2