Extracted

Extracted

• • Target

    bb96d7905bac85b63010f4c07a56a2c0c271f8eb88d7d563c9937fccd238691a.bin

  • Size

    866KB

  • MD5

    b599e6e7e3a4908be39d15243858b02e

  • SHA1

    fca69ba2b226f6cf6aa835e6cde61e7b4c8c8a65

  • SHA256

    bb96d7905bac85b63010f4c07a56a2c0c271f8eb88d7d563c9937fccd238691a

  • SHA512

    86738d1d11794ef880ac9c3559af737178e38a2ad2307a395dc0a2fd6688cfca5cb3bf28cbf493077da0ea8fd6b56631db4eda76751bdfcf01fc790907eac718

  • SSDEEP

    12288:ky90UroYWOdhbhH9fWIKzS9eRFiDus8Sr//5WzRwfq7L9r1P7sgglTw96W6PyVa4:kyvoYlDbhQ7uKFSL/4zR8E5rZxCFjk

  Score

  10^/10

  redlinedarkgenainfostealerpersistencestealer

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2