Extracted

• • Target

    a51b071542599d1e5428713cbd3160c261fa84dde9bb7e4f682b7fc92b79a483

  • Size

    206KB

  • MD5

    4b7302ac53a8b3ac22af1d9781e03e3b

  • SHA1

    5c8154844c22c1cf48a876eac7e5ac8d88dccf25

  • SHA256

    a51b071542599d1e5428713cbd3160c261fa84dde9bb7e4f682b7fc92b79a483

  • SHA512

    f9b01c03f57897140918e14111952ede3501e3b71305b925eda0bcc97f51faccf387fcc1e24373cd53ebf916b3781ac3fbeef4f02b4e4f60c580b667a88ca0a0

  • SSDEEP

    3072:meTRJ0kHbnpN23kQKp5XzutZXKGrpeN84LuZAIybiy3xEfbi:FTR2AnpN2wDurXBeBuZAIMEj

  Score

  10^/10

  redlinedizaevasioninfostealerpersistencetrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1