Extracted

Extracted

• • Target

    5c49d9f3f398e7bf0aa48b300bb1f1e8c60f39583ffdbbef574648afedf5a2d0.bin

  • Size

    1.6MB

  • MD5

    aec89ff0b1a792b6e454239c91e209b8

  • SHA1

    6cf3f5866bbddfcc5ba1fd98241502e354c9735a

  • SHA256

    5c49d9f3f398e7bf0aa48b300bb1f1e8c60f39583ffdbbef574648afedf5a2d0

  • SHA512

    fb3096573d768549cdf6716150f6d8198edeb02224ff7ab9241da522a86248b50f795dd50179b1b5180e03247848c4f590f66f324ce4cf3873c9481f5f8bc6e7

  • SSDEEP

    24576:EysIEELq7XWiVAz+QMXMfHot6goAP1JBni2ctmrIIGwWLPbDvtWnA:TsIE+CtWz+9XMfItr5XBn6c4nnz8

  Score

  10^/10

  redlinegenamostevasioninfostealerpersistencetrojanstealer

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2