Extracted

Extracted

• • Target

    71b92ed26df7f0bd34a2551b1c176a9a3f080e4244b43d55e652f08e9e3d4a43.bin

  • Size

    1.7MB

  • MD5

    b73a5eebf7777760c2cf6743d0595f66

  • SHA1

    2e5189dca49c8814579f5b73a293676aa1a54df1

  • SHA256

    71b92ed26df7f0bd34a2551b1c176a9a3f080e4244b43d55e652f08e9e3d4a43

  • SHA512

    14bdee985b18609cf75b8b80a899245b38b9e6f2d135ae2daf5dac65799f9d2efec56eed615bcc22f929d5dc77c03185821ca9a7360d6c65b5da213454ea63b5

  • SSDEEP

    24576:6y32bfrN3V598HdOAmegNQ5gYnVlzsm3KNiaptSzfvTvTYkqrPAiuvP5Ikn:BEj5L9KdueGQOYVlwcAiaQrvT+4i

  Score

  10^/10

  redlinemostevasioninfostealerpersistencetrojangenastealer

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2