Extracted

• • Target

    0b47b14e356616bf30f9e0f7205f98fa1a8b5a115c9fcc1d968b4b86e0b08dd1

  • Size

    1.5MB

  • MD5

    9b776b053559abac6e55df060e72d8fc

  • SHA1

    8672d2d8b754e2fdfa11094864c09bdec59538a1

  • SHA256

    0b47b14e356616bf30f9e0f7205f98fa1a8b5a115c9fcc1d968b4b86e0b08dd1

  • SHA512

    e7555716429524573b15a6e8aa322da6c84e08b912f9674b7197bca271d6a09b706d5e96a8fa1ea1025d71010ec0d79c40e4950cb82ea491713415178e45b1f0

  • SSDEEP

    24576:my/zgTVa/Is053sXwGrky/gPmORIpxl5ymjd7voB8GF+k1LdriVdQzzbaHjB0:1/zg0/I1j07KmORIvl5yk9voBJF+khB+

  Score

  10^/10

  redlinemaskevasioninfostealerpersistencetrojanstealer

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2