Extracted

• • Target

    2a0ad5eba1bf829246590659ff3522d0d9ac86dad67293dab21f9848accf7769

  • Size

    1.2MB

  • MD5

    06aebeb42954d9301ad17de3b7140899

  • SHA1

    69b470736b692362dd653983a06e13747e6551df

  • SHA256

    2a0ad5eba1bf829246590659ff3522d0d9ac86dad67293dab21f9848accf7769

  • SHA512

    b3b6110224e86d0b8277bba22fe23def6a184df884d41c2b0beef656d3da153fe29a54b45f610577efbbd5218dc41ebfac18f4ad953c05dba531a1313ded5382

  • SSDEEP

    24576:jyJivUEFrWs/cOdqOU1X0BPkZhIJKEPeT019+ig0yTlniUGFNBIH9ynRU:2I3rhjkl9LIJKo19+ig5RiUGjB5R

  Score

  10^/10

  redlinelusaevasioninfostealerpersistencetrojanstealer

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2