Extracted

Extracted

• • Target

    53c5e42f93ad280c6af692a6c2aaec59dabd21bcbb4ee4ca665ee15ad1676063.bin

  • Size

    1.7MB

  • MD5

    242801d705fc7e3455ec8e83d4152c31

  • SHA1

    fffdfc9d9f2d4b076d6a0d629c18abdc71077659

  • SHA256

    53c5e42f93ad280c6af692a6c2aaec59dabd21bcbb4ee4ca665ee15ad1676063

  • SHA512

    31bb345823f9ee6f78987137e49996c214cb2e53731f63eacdcf5037689f3f7202735daa6d62356f06f2170d034b25694bb84d0d1b4de4a552e2a0fc45f06588

  • SSDEEP

    24576:oyZBOnzNHgrUpXZi0VnVn4ZmrStXxWgpnCzL6GB7v5FkAHkj8BVIqhTIacUH2Kg6:vZUnJOgXSmOtBnng6sAAH63m3TpuOi

  Score

  10^/10

  redlinegenamostevasioninfostealerpersistencetrojanstealer

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2