Extracted

Extracted

• • Target

    e627eb486a72e06c66b331b52a9d63de18fdc8bd49d649c3dd71bcf58773719a.bin

  • Size

    1.6MB

  • MD5

    50f9433fb03966c218d14ed94c333386

  • SHA1

    54078dce3b1ef60723901d968c97b0cb91d93907

  • SHA256

    e627eb486a72e06c66b331b52a9d63de18fdc8bd49d649c3dd71bcf58773719a

  • SHA512

    fa447e63035fa9c6e857261bef1de0d5bf9ee0ca7285b3ccbfc7f76a1bf4cd0895e6764950a3aa45700a174f96e2dd1a0813b741d4a8645d80e6a3b8303b83c5

  • SSDEEP

    24576:JyzN6VWB41NkcagJWOIeh/0WRTtlPQ0YLzxe2A8caK7L9A3hWVboZfFccwsSfk:8IWW1qcoOoWxtxQFLl08bA+46VFI/

  Score

  10^/10

  redlinegenamostevasioninfostealerpersistencetrojanstealer

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2