Extracted

• • Target

    31ab3655887de6720f1b0cff9166245b1c5c154b613e01e11a186e04ea24f796

  • Size

    1.5MB

  • MD5

    6108d836010313d77b93aa0de9b89894

  • SHA1

    8a231e1ea5ef2109fe13a179e524589ad3d29dcb

  • SHA256

    31ab3655887de6720f1b0cff9166245b1c5c154b613e01e11a186e04ea24f796

  • SHA512

    02a1f21b5a3e19e1c8514f77121589a84c9aa10c39d150d539f283ffdefd285bbf1dd84b869e102888538ce37b350e4f0706744393986031390e9d514374e889

  • SSDEEP

    24576:Lyr4bwrkH9EeO8QvaaIAb/S7/obGt4fgmHbf5UIyvIha/MVbbDtckmidUkuHup4:+Gtsv2AujAGQ37/OIh8aVcXrkv

  Score

  10^/10

  redlinemazdaevasioninfostealerpersistencetrojanstealer

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2