Extracted

• • Target

    DiscoSetup472.exe

  • Size

    1.0MB

  • MD5

    3bccb3a4db7f015e9334cf6c4a3dbc6e

  • SHA1

    ea7be21a1e4d2eabc90d48a4cc11068fb9be5598

  • SHA256

    e7f26e55455a2a83d0b1cf17fa5061b18ca01d19f7f77c485616d1dd799f97ed

  • SHA512

    f444dba2a2cd1dfe31ab8ebd4fe0486a5e851a2e29afd81a39b9a7d0b87299706c3d624fbe94250082a66a91236a93d9f97496afc56103c4e335d2b81ac30372

  • SSDEEP

    24576:ky/Hi6rxDh55mgIdqK2XRa7y+oMO1ZNjCZVbuqh670nltJw3l4WR:zPi69DErqK2ha8ZNuzbSoltJw3lJ

  Score

  10^/10

  redlinedizaevasioninfostealerpersistencetrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2