Extracted

• • Target

    7e381dc6ed27aad28240e19ca8ce69f20aeba2eff253a246eb722b86f6a337c3

  • Size

    1.5MB

  • MD5

    ff284da9454b1b2202daac0826e279e6

  • SHA1

    9baa769e12fef2d18553a7f8ab38f955d78aba88

  • SHA256

    7e381dc6ed27aad28240e19ca8ce69f20aeba2eff253a246eb722b86f6a337c3

  • SHA512

    c5ae52c56f4693f82efb14500c71f35d66c528cb326962c020b38f76111a8b60bc2d9bd814a3d302223b2635134eb4016e2458995042a8d8ed25a781c8aee597

  • SSDEEP

    24576:jywRErvx0bDhOQz8wbYv0ipLm1kZPxEj05VZBs5bcRRtnp1N4eiKo2s6xr2wS:2wRaJHQFbYhLm1kZZEj0Ao3vwKo2s6

  Score

  10^/10

  redlinemaxbievasioninfostealerpersistencetrojanstealer

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2