Extracted

Extracted

• • Target

    238060b3d3b575244af943f372c0e15ad98ffdfea202facdbf2870c7f92e051e.bin

  • Size

    1.7MB

  • MD5

    2e5422bb3f5b9e3fbe169228e7cd65f0

  • SHA1

    3496a0aa9e2f6d6ea974736dfdef8d28efbe7d3e

  • SHA256

    238060b3d3b575244af943f372c0e15ad98ffdfea202facdbf2870c7f92e051e

  • SHA512

    4942b39beb0d2a9ad073b451ba206cb7fc7055da644cbe718f8d92d7400bae77ebb2d582914c8d9103cc8353e42a3808486b1e416c666ba10ee4d1bcd53cabfe

  • SSDEEP

    49152:I6xnRcsF7+NspHfU21Dl6uiXE98JgBiUvz:csFaNst86DlhD9iS

  Score

  10^/10

  redlinegenamostevasioninfostealerpersistencetrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2