Extracted

• • Target

    6ca05235a5946b540c8e7b8339d938a176dce2f7ec5a1b0ba44519a160333311

  • Size

    1.2MB

  • MD5

    b94d24de15f1cf31b109174df8e371da

  • SHA1

    3f12cb41f677dca63e7ce3159054972ee593e8f4

  • SHA256

    6ca05235a5946b540c8e7b8339d938a176dce2f7ec5a1b0ba44519a160333311

  • SHA512

    cbcbb04fd28079686729b40c571f45bf93e98ffc2b0b39eec8d6ad31397c11853f3004bdf531d9ca7f968b8f2d2d10a0070375ef998020d2249a4f394dc9e17f

  • SSDEEP

    24576:Lyk0MQzaPp60qBb2V4FIBqW5bdVCwyiqOkGc+SLtfhP1knMnjt8:+kPyaV4uqAbDyWkt3hh6nSt

  Score

  10^/10

  redlinelofaevasioninfostealerpersistencetrojanstealer

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2