Extracted

Extracted

• • Target

    ab61f8eec6552709a30b7be2680b637c649e711394fc55bb607d919efb9c3c0c.exe

  • Size

    1.2MB

  • MD5

    bd4dc0cf8ed8e06f4fb6bc06b62aecd1

  • SHA1

    6aa23b176fa7f8544422121d976e228a16b48d2d

  • SHA256

    ab61f8eec6552709a30b7be2680b637c649e711394fc55bb607d919efb9c3c0c

  • SHA512

    6e300075abc0e8675f61acbe736756ea76989a7beb03aa266d1a82e720a17009cf2c79aa58afa22738d428717f308de0d653e41b90a30ad6934212d8b7e899e0

  • SSDEEP

    24576:iyhaBb6G1K0zChckgEotr6cDxRy4pvCIr23egMWTpLjnsQ6:JYBbb1K0mhcPx7lvCIFeTlAQ

  Score

  10^/10

  redlinegenalifeinfostealerpersistencestealer

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2