Extracted

• • Target

    9c201196b4d6a9963eb726e82bec362384df55abf5fa3373ab4d26c7df79d9ed.bin

  • Size

    1.5MB

  • MD5

    634f3b71b7d6ae44d4caec2dfbe1b3a5

  • SHA1

    5e5632ac4e65d1b043fc5f0ab157a8e7e5160cad

  • SHA256

    9c201196b4d6a9963eb726e82bec362384df55abf5fa3373ab4d26c7df79d9ed

  • SHA512

    b1aa56edad81e4d30df7e840adde9a6e05bdaebc2934887d427f4e53e4dd3af2be04901afc23be42dff055ee1f46674946a4d0311d7bdd236c8897f7c5747bb1

  • SSDEEP

    24576:By1LC1zA0d3AYntgpuUamhA9o0Qb6yvK/Ic79HHoQcnocPc9RdA9NitFDByExf:05gce3AYnJ5D9oT6yvM97tjkc9w63B

  Score

  10^/10

  redlinemostinfostealerpersistencestealer

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2