Extracted

Extracted

• • Target

    eeb1e4b52d05ad9c691a1270d0f315d57b8ca8586e005bbd3bef501d4ef07fd4.bin

  • Size

    1.2MB

  • MD5

    e9861a8e9b3cccf1f82b14c0c15abe40

  • SHA1

    e884d9d4cd56fa0c80688e3f32b843dd5c06c93a

  • SHA256

    eeb1e4b52d05ad9c691a1270d0f315d57b8ca8586e005bbd3bef501d4ef07fd4

  • SHA512

    3a8a43af24f6163c9a771f6fc10760dbe94f82a631f8dbb64a02cde5d0fdc15aeafdb84d5c09b2a07497c8ddd2fc12546cedfad67f8604ccf822d18f01f196f4

  • SSDEEP

    24576:fy6IV4uwQr97A6a7GnjaDUJmgAnNVYRUVwhQr4fAJSdW/iKGx:q6Iyulr97JaI97yZw+r4pdlK

  Score

  10^/10

  redlinegenalifeinfostealerpersistencestealer

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2