Extracted

• • Target

    60a28689b00f56c7b1be1f893655711fb3a224add70d9e33a7623f05879e50d6.bin

  • Size

    913KB

  • MD5

    5daf97ba89d7bed2c23a92dd9e0d571d

  • SHA1

    ff37fe01e24b8302ef2a2337e08557b194e334b7

  • SHA256

    60a28689b00f56c7b1be1f893655711fb3a224add70d9e33a7623f05879e50d6

  • SHA512

    e1d305d57cf69631ab628874e63efdc869f72c12e17b740a0a2255dc46fc5b57635b0b5ea0debd127385b4cd6acb37ba172fa826c0b03db08431acf497cdbad8

  • SSDEEP

    24576:XyiB4WZhteQ1mwwzmqKE7ZxcVa3sWkHxQdg+:iGLtX1mwKmqKE7Zx38WAGd

  Score

  10^/10

  redlinedarkevasioninfostealerpersistencetrojanstealer

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2