Extracted

Extracted

• • Target

    34d501d1d9795634d430a2b2f8b454c30e9f45610fc67f6f65ba6cc293718e3c.bin

  • Size

    1.5MB

  • MD5

    f0cf02756df9f4cf86e28962a52a5e0e

  • SHA1

    18d657bb642c9904e499f7b785c6069508f91a02

  • SHA256

    34d501d1d9795634d430a2b2f8b454c30e9f45610fc67f6f65ba6cc293718e3c

  • SHA512

    31d41508c4a1929620de7cbe1ba2eb84989e2c391d76d95eac1f832886c2e45a78f46dcf3306b0b010002ee4a6150520a11d6decd669e47cb400e8f059c7dfac

  • SSDEEP

    24576:NylQ18yBDAeKestgjXpw5nvM+LAfd16qwXIQBti9rneZs7Ibjs3kHFJU2lb:oSGCKVtG+5vjLAfd17wTtarneZsi43AB

  Score

  10^/10

  redlinegenamostevasioninfostealerpersistencetrojanstealer

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2