Extracted

• • Target

    2abf01c6904189df5e656ed54b2bbb9fb98b4b5979c9221ac044e8e5b87957cc.bin

  • Size

    893KB

  • MD5

    5ac94ee070f8128587395d3555dab219

  • SHA1

    50fe1dc206e5ae76aff74581491c7af33c312168

  • SHA256

    2abf01c6904189df5e656ed54b2bbb9fb98b4b5979c9221ac044e8e5b87957cc

  • SHA512

    aea8e9121ebec5956b31a0971ea154766fc28830664dc828f05187d0e583b2f997b6a1149827d7980f053573fd6036d59fb62fb0790abbe45aa042604b79fe7e

  • SSDEEP

    12288:dy90cgHyvoZrpSrIyZ/421K6tNKMAFcs40eHUl/T0Y2tpDAp/2hIjqJj0/lteGem:dyDAyvqreX/twh7b0ftVA8IjqJjwcNm

  Score

  10^/10

  redlinedarkevasioninfostealerpersistencetrojanstealer

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2