Extracted

Extracted

• • Target

    b1d272e20ce9efe1de56db63670536d9cccd8c89997cd4f3d50864076d8985f0.bin

  • Size

    1.5MB

  • MD5

    1ac6b8d98a48f623b0786ac49364b41c

  • SHA1

    33c426ae172d579d7c23b96591862565275c1376

  • SHA256

    b1d272e20ce9efe1de56db63670536d9cccd8c89997cd4f3d50864076d8985f0

  • SHA512

    d9e23f098988d65f7562f2a405f9700a2bc29ddb4006287770349b730061f2a8d0f85739b5c736055435191feb764eb2eaedaf06ec9e308c73f03918978249e4

  • SSDEEP

    24576:/yn/1Yo2zcqm2iO+oie6tnILwsqhnIk2QQ+k/ka7fgkcK1eZAcPq/s3kH/Pvroti:K/GoocXjOxiztIRk2QI/pg/K1eZAZE3F

  Score

  10^/10

  evasionpersistencetrojanredlinegenamostinfostealerstealer

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2