Extracted

Extracted

• • Target

    ad204399c025f009a9aeac4c927cb7515a6878c3109124b0944912c9f955f817.bin

  • Size

    1.2MB

  • MD5

    58c2cdbc2aa7bffde6da05e41849ab6a

  • SHA1

    e32ae8e0d906647aa3d405b3e9d1596d879a1a29

  • SHA256

    ad204399c025f009a9aeac4c927cb7515a6878c3109124b0944912c9f955f817

  • SHA512

    7b1d1341f6629e243655122d680e5ff08cd75805daf38485157baf720a2dc5b1354c616493e3332effce0b046a650256606f20eb19a615c38c484509831f1d1c

  • SSDEEP

    24576:VyCiCrc9T+lxqsRy2xyagZPQNkOZfP3rHmQef41YVfDadmT07m:wJCrcV+lxqSxyjcFZf/KQefyabadmT

  Score

  10^/10

  redlinegenalifeinfostealerpersistencestealer

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2