Extracted

• • Target

    71b1fb3a4bd1a0ad65f5b3d76e1dcd57b249384be935369d3d34ad79cb16bb3a

  • Size

    1.5MB

  • MD5

    780d65ead267aaaa30d0b01869689769

  • SHA1

    ed5a250abd9c8ee0197266acdc4ed0c753c36479

  • SHA256

    71b1fb3a4bd1a0ad65f5b3d76e1dcd57b249384be935369d3d34ad79cb16bb3a

  • SHA512

    b753bc60b30af6efa129c75b424a410f781b57c38fc6c1aa7d38faf30e5ed93ba6e6bce3a54dddda9c33cca8c32220cddd820574771d27585b8029fa839e17ba

  • SSDEEP

    24576:FyZbC3YdhwtqQ6pGx6PLEc7fNBLHPGdhbKR155Tp2fUfLZXObaB2KN2:gZG3W9QXClb6hbKR15LoUNg0N

  Score

  10^/10

  redlinemazdaevasioninfostealerpersistencetrojanstealer

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2