Extracted

Extracted

• • Target

    00d9c56bb8840e2f4e3bf4ec495a46aaa8d4f5899f3f9e9aa70a4a0305d4680f

  • Size

    1.5MB

  • MD5

    2bfea8dd869901fe9369ad5294c7bee6

  • SHA1

    1fa7e69520c4fb3f80354675020fb06d13f4abba

  • SHA256

    00d9c56bb8840e2f4e3bf4ec495a46aaa8d4f5899f3f9e9aa70a4a0305d4680f

  • SHA512

    9eb7032d0a1ec945aed7f343b457eb44033bcd2d040506918c1cfc9c6f95f387d2efe80219d669cbc0de747f164f690c5c69afe2e42bf93fb0d4790b23e6caf0

  • SSDEEP

    49152:SOyOxLiPFJ2CwctWsb7OmvVk/tcm6BzQ6qQlPY:zri1ztWsnOmvVc6zQ6qQlP

  Score

  10^/10

  evasionpersistencetrojanredlinegenamostinfostealerstealer

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2