Extracted

Extracted

• • Target

    423ca66867520bb1e79c644317532625feb88b72db7b73b4b510415a00e091fc.bin

  • Size

    1.5MB

  • MD5

    a118de37b6b9b15b9e146e8cfc2f604d

  • SHA1

    393355a7de705e5456fcb27902a12f26f02817f1

  • SHA256

    423ca66867520bb1e79c644317532625feb88b72db7b73b4b510415a00e091fc

  • SHA512

    0e4b6800ead7c639012dfe88ec2aae47e0ffc856be91cc421ef6926aa5be31c30e29f29de96be6294556bf99161bcc23bfae63cd72664051709c238aaaf70fea

  • SSDEEP

    24576:fyYlkL/XvN8UUM3wF/5qthzWU7S+kvRJDLvtcEIEELnAjEh+1vT+Qgz6H:qYlkbS5sK/Itt/7S+kvzLvtcE5Mh+1qp

  Score

  10^/10

  redlinegenamostevasioninfostealerpersistencetrojanstealer

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2