Extracted

Extracted

• • Target

    661ff79b4f9f99c08f0713dff23be5b915e3494fd0cbb50748052238684a88bc.bin

  • Size

    1.5MB

  • MD5

    f5b7b2cd638746dac926ddd4ee624f4f

  • SHA1

    1c547686665bf5df096800de6f8fdcacbdf4cff4

  • SHA256

    661ff79b4f9f99c08f0713dff23be5b915e3494fd0cbb50748052238684a88bc

  • SHA512

    d9fb26d8d75b7a0619ed1f7b2846abc8228c0894e48b2873a462529b6bd39cd853bfa8a4e5ca94cb150d926fefaf72cb563724422b0925518e4d0824d6b75152

  • SSDEEP

    24576:sy0zhq7F9yhDvSff+AKrctP7beLUimrcc9nkxMO7iOejEEU9WKRVPqeZmvFjFs3W:b0lO3qD6vKAtTaLUimrcc9kxMO+OejE4

  Score

  10^/10

  evasionpersistencetrojanredlinegenamostinfostealerstealer

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2