Extracted

Extracted

• • Target

    d68693bf6df54d56881e005c00c4a64dea7c2beb7b7399accaa9b28aac83073c.bin

  • Size

    1.7MB

  • MD5

    6102ae8c7fe91d0220b67e397d44c6fd

  • SHA1

    f86fb698c586f2f14059c84a96986be00839c7ae

  • SHA256

    d68693bf6df54d56881e005c00c4a64dea7c2beb7b7399accaa9b28aac83073c

  • SHA512

    1e1f09283d214c9b77b1f787f36b86a19554f121677b4c2edf0fdd7a898c77050afabff54a0b1f3c75b4a7aff5504367c75f2e8303518b5b45c5008a8fa89421

  • SSDEEP

    49152:FOAU5alHP961tYd9EhlGqextzMy883F5cgcd:MAU5olgtYd9ElG7IyZ3F5cJ

  Score

  10^/10

  redlinegenamostevasioninfostealerpersistencetrojanstealer

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2