Extracted

• • Target

    bf6f2187eb1f65aa3597a8a8822da3886406d30aaed132cf3d137ccbecf89b10

  • Size

    736KB

  • MD5

    af714950c9d94ccba685d6f9fa5bb211

  • SHA1

    c7203082a8c85bdebdbde81302ce23151ab24e3c

  • SHA256

    bf6f2187eb1f65aa3597a8a8822da3886406d30aaed132cf3d137ccbecf89b10

  • SHA512

    81a53c61cef4d85dff65e7960b9d10a2cba24a566384dd040c84ba1728d03f1cce44cca565884ea1ae33d48105f820e0038deb558b12df367d9c315ec09887ca

  • SSDEEP

    12288:lMrmy90+5YoQQTyu3Xl9N/V8ykbyoocWzfK68yqt0e9bKrzsF8tBe8jPf03:/yUsm0Xl/V8+hn8yi7Krzs0e8jE

  Score

  10^/10

  redlinemaxievasioninfostealerpersistencetrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1