Extracted

• • Target

    3bbd402d2d675fab413e9310c8719377ede054dfa8a21f3a394098a28ec874ec

  • Size

    1.4MB

  • MD5

    afd448d2adbd259e497e57a1178fbccd

  • SHA1

    7e98d3512e36c195db6078c6f1012cbfe4ae2c59

  • SHA256

    3bbd402d2d675fab413e9310c8719377ede054dfa8a21f3a394098a28ec874ec

  • SHA512

    3723d1c0fcf265636c5039e9d865e72ee39854b32bc2e3fd21cbc0e595583121ab24c50492c1d2173a828f40820f1e89b39d61a5f6810381850894a4f0cb7c05

  • SSDEEP

    24576:Ey9rvA4PBSse5pE8xw/lxVlcT2nWulbelIyeSB77TfnSonuSdL5j1ScWH:Thvex2lxA0lW7/VuQj1S5

  Score

  10^/10

  redlinemaxbievasioninfostealerpersistencetrojanstealer

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2