Extracted

Extracted

• • Target

    a352ec3af9d2ab8ff445fa8baadaab7c6dcc0f3876014f32c56fb1b596076283.bin

  • Size

    874KB

  • MD5

    e12bd2dfdba8cbbe15e30815468e284c

  • SHA1

    3f69b2d9d3e558d38f686e4269d0c03b3c843b6e

  • SHA256

    a352ec3af9d2ab8ff445fa8baadaab7c6dcc0f3876014f32c56fb1b596076283

  • SHA512

    d524939a1362febc3d2dd18d98e94f3426d0046b80d4d7b8f97b14d3595ded822c7a498027927af0c79b95e9d4f9649f903a4c67ae340c70204ed1718249b72b

  • SSDEEP

    24576:1yulXQFd2GwKYI9X2kvOzjAnS1IvDkXY0CIq:QuJWw1kXRhSKb8KI

  Score

  10^/10

  redlinedarkgenainfostealerpersistencestealer

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2