Extracted

• • Target

    bdd10924ef4656d290b7285797ca3931aee97a88e510bdb7d163a1bf1aa83957

  • Size

    722KB

  • MD5

    799c10b2f2d20f3b4d6333a77784a6ce

  • SHA1

    b36c77a1779251a5fe7b8ee229a9960bc0cc0463

  • SHA256

    bdd10924ef4656d290b7285797ca3931aee97a88e510bdb7d163a1bf1aa83957

  • SHA512

    b9bd765cf17c9310e7165ca2df8e2423c0b048c46c2bd251a050a5e79d41bc5e06d1dd2629ae663ae35297bdb2052ac758f2d27e8718d1c8ddd185af702b2829

  • SSDEEP

    12288:dMrgy90HdavB8HjuWiZjwp/yfI0AiNu3gggKaQ5Tj/MXDGb/sM+rE9unKL5RGa:dyMWB3BZjM/y7Nu3oKf0zGb/sHrE9uns

  Score

  10^/10

  redlinedasaevasioninfostealerpersistencetrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1