Extracted

• • Target

    c200bc513ec20affb4c135af8ec8d94bc6db688e00c2add59ad1903264546a76.bin

  • Size

    1.5MB

  • MD5

    181826e9fb56d1468f454b9a2ac58f7e

  • SHA1

    c562e699297d0148be0bd666f3b7a9b1ce7753b7

  • SHA256

    c200bc513ec20affb4c135af8ec8d94bc6db688e00c2add59ad1903264546a76

  • SHA512

    0969e742ea2b1856e115483b97d26536a6d404f6c280cc3d1bb6a85c557f7d5d4185b3fc54fcbf0018bfd9ff272087eb2371a46067608b4d0e4015226f844ffe

  • SSDEEP

    24576:NyC1NQ63VXpZd2PLBl6gd2brWwoSDz2OPzlqSP0UGjGSx/C3W7vcpNwgzB4ToHIz:oC1vV5b2PLBl6zbrtVuOPzlq20Jf6G7t

  Score

  10^/10

  redlinemostinfostealerpersistencestealer

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2