Extracted

Extracted

• • Target

    71f7fb436946ae6831430cbc041e18c57ebecbb6da7061536be06b1803426001.bin

  • Size

    893KB

  • MD5

    d777f047d742b1c50257e42eba59a9b0

  • SHA1

    9958804e06d3b267ed7cdef316fbd32c22a9a91d

  • SHA256

    71f7fb436946ae6831430cbc041e18c57ebecbb6da7061536be06b1803426001

  • SHA512

    24c28d943c92eace81fcd49012c9268e545279f62674c461f20c28e915a3c0ee490654d9cca7728ca7f2e7dc2a5a60f1d4dda296154414e56b7456066068f2c6

  • SSDEEP

    24576:TycQYc4RdL/3trTMNRpcTTfiQbdK021Q5:mxYnRdLPtPMNRuqQ8h

  Score

  10^/10

  redlinedarkevasioninfostealerpersistencetrojangenastealer

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2