Extracted

• • Target

    27e91e8408ab84a57ac35d2aa131578aa7fd35c7a02b2f9be53100a3bbabe786

  • Size

    566KB

  • MD5

    e034286f1b2cd1f70d0865a58e7a52f8

  • SHA1

    7e0cee8b6127befcdd21260c670aea59a6a03602

  • SHA256

    27e91e8408ab84a57ac35d2aa131578aa7fd35c7a02b2f9be53100a3bbabe786

  • SHA512

    99caf605c9d9a319dbe13f94953007e75fa9955b7676c7758e34aa9a65c5ac7dedec8040ee6835a88d8894915e9f027cfb4a29403a76673e22882f3f4a8083d7

  • SSDEEP

    12288:5sMrxy90J/gxoOq+K/A9Krn6cbLu4l1j2qTr+vCMUOX+cqOwT:zyCIkY8r6oLl7e9q3

  Score

  10^/10

  redlinedarmdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2