Extracted

Extracted

• • Target

    bf72eed0b068ccb9f53c9c9724c9d6b8d5431fc87aa0a01cb74b0b408a41d69f.bin

  • Size

    1.5MB

  • MD5

    1828a63a05da25f62411b2bf1ee911bb

  • SHA1

    507b92d0443c889d132cc604128f21ebdb731987

  • SHA256

    bf72eed0b068ccb9f53c9c9724c9d6b8d5431fc87aa0a01cb74b0b408a41d69f

  • SHA512

    872898b693052c3150c346b26844b683c932727e9fbbb265f1f1822f7c7efd7ba31f6f9b0909c5c85cd90690b55dddc2658920fead2fda5380f131d611a10049

  • SSDEEP

    24576:Lymw2wd3PbEOCZ6ktr3ACErUL3Dz3LhdIOWXNadBwj2oMAK4RVk5BxA59B2:+J41ZHtTACEk3TUlNaMy0HwE

  Score

  10^/10

  redlinegenamostevasioninfostealerpersistencetrojanstealer

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2