Extracted

Extracted

• • Target

    b126ef97c9726decfff9b281b6b3909ac2eb153539f12168e675f2ca30c19d2e.bin

  • Size

    1.7MB

  • MD5

    17fa53269130eb7028dc59c0b77aaea6

  • SHA1

    931fd111aa0933bff5fda464ec17d4ac02f4af58

  • SHA256

    b126ef97c9726decfff9b281b6b3909ac2eb153539f12168e675f2ca30c19d2e

  • SHA512

    42efc60b8db39a19ef1e34639da81b63c9986f7d19800041bdec2bb8847abfc457c82a47f0d6b95b52b9538062161ed04493a1115fdb09d0c4896db0a05ab6a7

  • SSDEEP

    49152:YE2dgRER9QtVJLxSoEBFGPRwZELVwWTQOS/R1:dUgRERytVJLxJEBFGeZS4r1

  Score

  10^/10

  redlinegenamostevasioninfostealerpersistencetrojanstealer

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2