Extracted

Extracted

• • Target

    3b08ddd0208e43a4a2fbd089968b5fc44cefb4da02a49fe905fe99d39dbf2bf9.bin

  • Size

    1.6MB

  • MD5

    a28e73dd8f62866858b28c8c222df39b

  • SHA1

    5eb33eb6be4a40df5f52e7b4da2c9de0b0d341ff

  • SHA256

    3b08ddd0208e43a4a2fbd089968b5fc44cefb4da02a49fe905fe99d39dbf2bf9

  • SHA512

    4ffe91c46ab39bf7355b77f00efabbd7841603b73d1e86624dacea2d93d893f7e2b47c19f03e37e1e1510cab05f654249cdd68e8e75446cbb5cbeaadc4e798cb

  • SSDEEP

    24576:XydpI4IHIYpOgQWVmtIfNJUQE7fXjZJwmNqXjic77IxckqJ5aplvD:iBIHI/WwtgN69fnTpZ

  Score

  10^/10

  persistenceredlinegenamostevasioninfostealerstealertrojan

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2