Extracted

• • Target

    597ad14101937d820933b6161f6fa027f80c556958d88d08782dc9bc10478b55

  • Size

    924KB

  • MD5

    cd00bd99e5cdffbcabb6b929378e937e

  • SHA1

    6a341567793c2354821b1572af152d4c73bcaa28

  • SHA256

    597ad14101937d820933b6161f6fa027f80c556958d88d08782dc9bc10478b55

  • SHA512

    e0f9183c2c509f972bde8ffcd0f328f3972b1339caad9a2f8cf250548c28e8ffd1f941d831876abc0a50b5f439febb7d900f16ca55a6826e48a5d26b24c9813b

  • SSDEEP

    24576:2yo/JQt86cO5dhHVZXDRpXgFpaVtVkiJDexh2fHiOUt4F:F0JQt8uDVbgFetZKhMCB

  Score

  10^/10

  redlinelupaevasioninfostealerpersistencetrojanstealer

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2