Extracted

• • Target

    efd4e5aaced9e475be35bc2147fdcbf6bc8d9fe05ec050f2b052cf40691caa4c

  • Size

    752KB

  • MD5

    49ab72d99de7f1447091a88e30691f39

  • SHA1

    b93c4cf79c20e0e9e4f2b60eba0e6d537bbb3110

  • SHA256

    efd4e5aaced9e475be35bc2147fdcbf6bc8d9fe05ec050f2b052cf40691caa4c

  • SHA512

    f37b5d64e1c25f006abf09929ba093c4927871f8513befb2a4b28da12f6f1ab0f5535730923f46e7a0353f55e7c93842be0ebe3894864b298e666bca29e58999

  • SSDEEP

    12288:HMrsy90wwWVz2wB2Iy+FKtobQvimKBWfDfg09Vr3t4FkgsDhlMSuYvVS3E:Py/Z2wc8KYQvitwDY0/3tfgsMSuYg3E

  Score

  10^/10

  redlinemaxievasioninfostealerpersistencetrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1