Extracted

Extracted

• • Target

    19045b9ed0256f50243eaea4b1a77f7c2c84ab050f2b400d31ebcd67f43c209f.bin

  • Size

    1.7MB

  • MD5

    a7b17135266fc09925c99a881eb185cb

  • SHA1

    48392c6c123d3a1a2c2cfde24a0972e17a04d7c8

  • SHA256

    19045b9ed0256f50243eaea4b1a77f7c2c84ab050f2b400d31ebcd67f43c209f

  • SHA512

    5e5a04cd36c4001ebc8f5f30c735031bb6431d9770e2046f0ab1e227bc148bfa7102c1f9ee56a0051764fb1c4ad9f1e953503077766844895804605bd1533dba

  • SSDEEP

    49152:4FJjmsyGAiPYtCJZemI1ocU/rObsY+bf4pX:uZmnGBQtCSm/Cb+bfAX

  Score

  10^/10

  redlinegenamostevasioninfostealerpersistencetrojanstealer

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2