Extracted

Extracted

• • Target

    e9fc77f2576079cc93a9cdab910dbd739274788de3e68f8cfa0a22d58355d3f4.bin

  • Size

    1.7MB

  • MD5

    f081e289db78c0a1f3c9ca009b560271

  • SHA1

    cfd5808589a5a268d9dc9226c6c1489bbcc4e815

  • SHA256

    e9fc77f2576079cc93a9cdab910dbd739274788de3e68f8cfa0a22d58355d3f4

  • SHA512

    455a6510837e017f9723eb40e4f165e80fc72d635293556859cbd68da334eef66026d64386cf754a40b3c8580edd04a01b4fa9f8348d2c930a5966a7d8ac68af

  • SSDEEP

    24576:iy3lCtTj0cBrigIy8hC4R1tLxoqR1iWmEpPwi5TTL86ls0NwwKqS3oQ4zlULX7rr:J3YTj7IXQ4btV9DSi5z8wzNwT3oG

  Score

  10^/10

  evasionpersistencetrojanredlinegenamostinfostealerstealer

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2