Extracted

Extracted

• • Target

    NEAS.45116227ca494c9ce1885a027a923a70.exe

  • Size

    1.0MB

  • MD5

    45116227ca494c9ce1885a027a923a70

  • SHA1

    2549fe6532c4911ecee89e703ef90214ef5ea021

  • SHA256

    98fd7078a33e9ba1754361e16b2fe2eb78a373102eb859e96e9d2b379edb0a5b

  • SHA512

    a6852ee760c4b234bd1ce8eae1c81eed6b0045f74a0e3e79815026c5e2e677b17bb8463c899e2b844f1fda66b69ed1d343867293aaab41a1bf3e7eae62814cae

  • SSDEEP

    24576:ZyET8NE0vYyQiR5gEq+agu2HMYF6Mjhu+xye2N:M28DYy+w7Fb3

  Score

  10^/10

  redlinesmokeloadergromebackdoorevasioninfostealerpersistencetrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1