Extracted

• • Target

    c01c604aa928dcb35c9d66e0bbb714d03856dc0fe2eab3b5329f6103fb79696d.bin

  • Size

    1.5MB

  • MD5

    2e4f792c1285c9c1aa71e35459be1af3

  • SHA1

    5d6f1a53c693c10f331a2a8fc207d06129914280

  • SHA256

    c01c604aa928dcb35c9d66e0bbb714d03856dc0fe2eab3b5329f6103fb79696d

  • SHA512

    88e0529ffc9b956b091e0fe94c731ef988c3bf159358a5904a636199f9e371fbd22cc87f00109a6f9f9c4d21fb3f13098e24be901e260224584bc4802dac6451

  • SSDEEP

    24576:yyio2vUJDF3HRvKOlR3JJG32E6KCVRH6gUT4zYVosu/WfE1N2OS6L7kiTYs1Y:Zio2M3X/JJGGFRagUXVSQE/VSKrMs

  Score

  10^/10

  redlinemostinfostealerpersistencestealer

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2