Extracted

• • Target

    abc959c3c3861904103d0e97dc1273e99c04af7b8cdceb94f07bdf0bd1606f51.bin

  • Size

    1.5MB

  • MD5

    5481001cf94ea8e63b1bf57592f61bf1

  • SHA1

    bb2fe5a6a25f36f5f00ed0237bc952eae3c17ab4

  • SHA256

    abc959c3c3861904103d0e97dc1273e99c04af7b8cdceb94f07bdf0bd1606f51

  • SHA512

    5e58dfdd3cb6ea11daae710df92cb2aaa0f4a2d8f4c1aa1ee71a11669b2c31c0b38a3850e1e86deb6a3f8dd06b6e880dbb7c362c9b19d5853ff166060d5574e6

  • SSDEEP

    24576:7yApKFWxL9OXdlIpXevJE3X9xmUjRrvAanSriJBP6HTbQ:uAEFi9IIX9dYUlrCr2mTb

  Score

  10^/10

  redlinemostinfostealerpersistencestealer

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2