Extracted

Extracted

• • Target

    28b13e12497847c2aded07d3f9d53c975203c9cebc891202ec4ab4156a4da08b.bin

  • Size

    1.7MB

  • MD5

    b5665cd5feed2dc33394bf1b5e45e383

  • SHA1

    670badf6d3fe37a45195cd28d9ffd7a0439f8faf

  • SHA256

    28b13e12497847c2aded07d3f9d53c975203c9cebc891202ec4ab4156a4da08b

  • SHA512

    7707ddeadd8c4c14f391e40342c52f02eddd92ce3bfcb67b5838bbca3f19e7454b3a8fb8eb2a84a08bc54a00e388f73b532005a1192df5a3a5766317a9b10e27

  • SSDEEP

    49152:smJa2CzLtlk2RxkyJ3I0z1T2i+Na4IKNHq1FRO:42CPtl7RxkyJ7TpGbxqHR

  Score

  10^/10

  redlinemostevasioninfostealerpersistencetrojangenastealer

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2