Extracted

Extracted

• • Target

    a928cb0f86642afc5cf59eb9d0fa1a3ea21136021a7239582dafac9ce44c1a66.bin

  • Size

    1.7MB

  • MD5

    2114695eb7d0a773a486b2af372653c1

  • SHA1

    52ae567eae76a65c56259d109866cc53189c04b8

  • SHA256

    a928cb0f86642afc5cf59eb9d0fa1a3ea21136021a7239582dafac9ce44c1a66

  • SHA512

    15c189c774fe3251d32e0c16289092f9e72677bb2c3172b9c0475df9f88714113f446b13b2e6238777098dba95f7d9568920700385e63705bbc28a532dce3fba

  • SSDEEP

    24576:dyPEnvEBj1WKFph54CCtVw9+j881MZnhYY8GvNURGaTXnbD2bCQExpMC:4cezzeptGow3nmY8rTXnbSb

  Score

  10^/10

  redlinegenamostevasioninfostealerpersistencetrojanstealer

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2