Extracted

• • Target

    8eee8811ca351d2368545fd1f90e4a79.exe

  • Size

    691KB

  • MD5

    8eee8811ca351d2368545fd1f90e4a79

  • SHA1

    d00e0091ff19ce447a6cdf40ab45b505d27b530e

  • SHA256

    88afe93ae0c0b55466b8ab3b6addfa7b17244de29749a8bb7061966a55d187cd

  • SHA512

    b3fbbd0f82dd418ba4422639d597fd0e59609813e9c049dbdb69c6faf186fd64f07e114412512a94f2c8979c8668603a30771cadca9379f15db3032a1d9b4b16

  • SSDEEP

    12288:1ElCrctQ2PBsUJG5MQIj4rHNUA75zbpsCYlLxSXQjJDaYek+/n:ylCrc7dY5MB8rHLzAldYG0tk+/n

  Score

  10^/10

  redlinenarkoevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2