Extracted

Extracted

• • Target

    c3e52ff29acfe7d1ddaecc5da10715c86672cc274c9ecbfe1fc1cba7d1fcaa90.bin

  • Size

    1.2MB

  • MD5

    049bef1fc4462ad39b94752f4b7bddb6

  • SHA1

    5cc85884d54fa899b84493df251e6db9591c3042

  • SHA256

    c3e52ff29acfe7d1ddaecc5da10715c86672cc274c9ecbfe1fc1cba7d1fcaa90

  • SHA512

    024f28033a7827aceb843412abddee1f4353de4bbdafa2e9455732acaf0290057daf5c81acbb9b56c8ecbd3c4049ea7824e77521169ea3ebde27b9408d131d0d

  • SSDEEP

    24576:kydVqhtSVsjDuKDpB1g5XZCBGAARrsiei22RBpc6FMVNDY2p+:zih6sfbvICR4z2rJp

  Score

  10^/10

  redlinegenalifeinfostealerpersistencestealer

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2