Extracted

Extracted

• • Target

    a261d1e672e7ec157532d7575f844f60c22a86d6090f7a60b954564db3e86786.bin

  • Size

    783KB

  • MD5

    f2d44afbeee16bd906dbf47a6722088d

  • SHA1

    086b57717d947bee6dccefa8fe570817b3472a74

  • SHA256

    a261d1e672e7ec157532d7575f844f60c22a86d6090f7a60b954564db3e86786

  • SHA512

    534fc262275283866f11cf9397fd1e47a41dcda6cb444ee114004d2448cd39834c54d97b4bc5f3e4eafa0feb19239370ff5a84199d9f5b76b560952dbec88697

  • SSDEEP

    24576:lyTbWN31lrbRbHMIIdHU2/1SodURRKz0GO2:AetP5bHMrdH7dSXRR

  Score

  10^/10

  redlinedarkgenainfostealerpersistencestealer

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2