Extracted

Extracted

• • Target

    5ef554cd0a345bfbb66252fb2b288b802d5801a26ed5723484cea2f3e352e308.bin

  • Size

    934KB

  • MD5

    cf092e69e5f17a7774c5657dd8836498

  • SHA1

    c1360e88789e4a1dbbb6ee9d296e887b4a0e3058

  • SHA256

    5ef554cd0a345bfbb66252fb2b288b802d5801a26ed5723484cea2f3e352e308

  • SHA512

    bb213ec308688fce3c588c04fe5969ffc8e5f79cd36fd192be39775d075d4196179947f943e4b0b6076b442e9abbe3997a05568dc219eee7de8dda13bf47ca16

  • SSDEEP

    24576:OyXac2I1j+aRbZYLh3gmo5ZJUKcFKRP/qk6grpe:dXac2cSWbGN3gvmKRv6Cp

  Score

  10^/10

  redlinedarkevasioninfostealerpersistencetrojangenastealer

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2