Extracted

• • Target

    eef2772c37e31c9f1400ba3bb38e77922a3099771f5fcf4be669c65b9c38fdbf

  • Size

    560KB

  • MD5

    be335d601e2c6e34197ce189533dabad

  • SHA1

    0627bb8020d664229f3e20ed56bb996bd480ce08

  • SHA256

    eef2772c37e31c9f1400ba3bb38e77922a3099771f5fcf4be669c65b9c38fdbf

  • SHA512

    b2dfbba5d0578fa8d92e5496a11db6c2027c58b10a1b659683511320449ef3efe59cfa1dd7bab5521aad7d7be05150862504b60f7162071611cbeedf596fcb27

  • SSDEEP

    12288:QMrLy90YmNbZ+o+kg/rfPt1ut0w5eVHNbHMH0Np:LyOVd+kgPut0w5IeHKp

  Score

  10^/10

  redlinegogenevasioninfostealerpersistencetrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1