Extracted

Extracted

• • Target

    b85eeeeec6d8fefd0bc65f0c6e32723403e00e4a914587de4276914ae90cdba1.bin

  • Size

    1.2MB

  • MD5

    7f64eb5f2b02821319122be2862e399f

  • SHA1

    2c966000c046a4796257a2120778caa745752ec2

  • SHA256

    b85eeeeec6d8fefd0bc65f0c6e32723403e00e4a914587de4276914ae90cdba1

  • SHA512

    5a90e9a9036f955b22920230b45d7a00cffe3b3adc6fd8d08803935ee98a8bdfc79edae72499f1a24aed4b286939aafda0b6f491586860435c0743f9cc0b7fd3

  • SSDEEP

    24576:/y/WntQtsFWZW9R1O87XkrSewiKcnfyuPfd/Wis4iwRsXL2AhdIaQGuYLCwu:KunGtWWZeYr2ewofTHd/hiYZ9aQGnd

  Score

  10^/10

  redlinegenalifeinfostealerpersistencestealer

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2