Extracted

• • Target

    6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe

  • Size

    145KB

  • MD5

    2ef95efdbedb353a82497ab63aa39067

  • SHA1

    a7784438c0ca3e37d63fc409435f6a5e96f73f41

  • SHA256

    6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b

  • SHA512

    1c053e93ffb29b7ef556e898650e447e8f3c101e5eb491fdd68adebc98434745b69fabf959db3d5fb0993b2be8c06f448d0b031de88024d7a4d37fdcab8dbfad

  • SSDEEP

    3072:X3gonQnBpzMo4JPj5hMVXUgbRZlIwTqeq+3r7E4sf65NiJtmghrOy7BCRIVCNfD0:nDnyMVIZLT

  Score

  10^/10

  remcosquoteevasionpersistencerattrojanredlineinfostealerstealer

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • UAC bypass

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2