Extracted

Extracted

• • Target

    d9961078880275748dfe5c1feacfc4eaa3d36b0a756442f8abd5b3e017ad6301.bin

  • Size

    958KB

  • MD5

    0880b929248e5942fad8df617ecae158

  • SHA1

    26da18282217fc82ba397c3f479f034d808fadfb

  • SHA256

    d9961078880275748dfe5c1feacfc4eaa3d36b0a756442f8abd5b3e017ad6301

  • SHA512

    cab34fddfae51770c5b9f80e56aa03a2a8202aa478e679125b04308985ca95e47f8d7305d25012e3e3a51309c0227abd3fa43bffacf2d73ec03b2b4560a37413

  • SSDEEP

    24576:LygAURYBwtzuLnYbKk+wTWoue0yrpZOnZf/59msIkHJSf9O:+gAU2BUz2nYbKk5TWoue0yrXOnZfnZIt

  Score

  10^/10

  redlinedarkevasioninfostealerpersistencetrojangenastealer

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2