Extracted

Extracted

• • Target

    0210683b42aebecba2b140079ba1eca2916c55e32751dd5ae126896c9b3f116e.bin

  • Size

    1.5MB

  • MD5

    ab7c36f0643e27d4ec1eb6d203a0e4a3

  • SHA1

    b3a365fad1c30305daa1fb8425a45a67d189164b

  • SHA256

    0210683b42aebecba2b140079ba1eca2916c55e32751dd5ae126896c9b3f116e

  • SHA512

    a002f7a45b652b01b0666cf2eae172c2ffbbfa8e4096ab6ad6530fa09b650d76c175e489ff22d2d42e3907bd2e04fbb9678cee48525f2ecc0b090c926c109a1f

  • SSDEEP

    24576:Qy7RI+6ztooqIpp7zUzJ4atem5vuz4qrIbmn49J+RGkkR9eZsWIw4s3kHnkr:X7y+CcIb7zUJHt35ve4qr8m49cyR9eZI

  Score

  10^/10

  redlinegenamostevasioninfostealerpersistencetrojanstealer

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2