Extracted

Extracted

• • Target

    22ab4fe49dfc5687027446f54dcb7ee76cb02411f7a4395bb7f825940b000ddf

  • Size

    889KB

  • MD5

    254f0eeb69556c4f416f371ac15dad36

  • SHA1

    e17df55b0cfb6434b2fdc75e727662cb6e8be973

  • SHA256

    22ab4fe49dfc5687027446f54dcb7ee76cb02411f7a4395bb7f825940b000ddf

  • SHA512

    febd6e3d077b931299a9b37d93016f2187e8f2c97849813edfbb7ac1344177d74c91f9d7ca59d21a8666cf0294c795ff86bb5771f688cc1f2316b58973f4279d

  • SSDEEP

    24576:pyEgN41Q4N8EiZCaww2XBCi88WcOS9OY:cEgNwfNLiZt3uB98VhGO

  Score

  10^/10

  redlinedorkgenainfostealerpersistencestealer

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2