Extracted

• • Target

    39554c80d8362dd259d61f5947a4b006dc1cea86d7d3a63752495c8b2168473e

  • Size

    1.3MB

  • MD5

    8990f412b5dab379ac33edf54c6a407a

  • SHA1

    c34f1f95eeb165fea9760219e54008c17a0267d8

  • SHA256

    39554c80d8362dd259d61f5947a4b006dc1cea86d7d3a63752495c8b2168473e

  • SHA512

    e850186e07c7807bc06f54278e7f3dfbd754cfc55d4d9245bf3451e926862f598382a9fc7d0c5d51a6efe6366530efc7b588786f8407914fa75451d790278bbb

  • SSDEEP

    24576:oyG9/SvM/vhJL/7FA+/u934mDEJIikfF2lUobykO0aXETKZrdXXs:vBavlG93YGFQUIykhaBZrB

  Score

  10^/10

  redlinelakioevasioninfostealerpersistencetrojanstealer

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2