Extracted

Extracted

• • Target

    dcadb0a6b56e6dfc56c5db613e91f5953e66b73ca87f497f3fd33936b5f4c925.bin

  • Size

    1.7MB

  • MD5

    5eca5616b620d4478e81652f904e053b

  • SHA1

    143173ab27e3a31691ba72c0b67832d20d5addf7

  • SHA256

    dcadb0a6b56e6dfc56c5db613e91f5953e66b73ca87f497f3fd33936b5f4c925

  • SHA512

    0a63bc3ac6dfd00017f618ff06197378f34760f0201d58ecc1f0e5236c204dbeaf9fae608b1860bc1a7baa08cee768ba94f01e3fecdd51564785210572838ce0

  • SSDEEP

    49152:vTwQfAawRZwM6tGhBXv4wSrWDCqnS7bn:ZfAsNtGhhv4wGWDCjz

  Score

  10^/10

  redlinegenamostevasioninfostealerpersistencetrojanstealer

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2