Extracted

• • Target

    9e5423d5a22997091e63297a8975fc23157e1f1556b44f5bc0f83c624eb3a479.bin

  • Size

    1.5MB

  • MD5

    3db91fe92a84431d50f05a683476924e

  • SHA1

    2422d232d17ae36c372eade0cd8c2eb7660db6bd

  • SHA256

    9e5423d5a22997091e63297a8975fc23157e1f1556b44f5bc0f83c624eb3a479

  • SHA512

    817e40559190a1dbeb27d723593c345cfb798cb6e2cb5d16eb03c6dfbf3ed77840e29314d8687a7dfe1b8a675fec0ea87974e518291002aa681997c8ae80b3b9

  • SSDEEP

    24576:/ywwKtM+h9o9iZwbkQN7MdFHBULets2t5686TEY11aiQ+BoK9o/8n4yJDPYFp:KwwV+hug2kQCdFHBgeChQG19BJ9o64yK

  Score

  10^/10

  redlinemostinfostealerpersistencestealer

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2