Extracted

Extracted

• • Target

    cd91974381bd2557f7b980d4592ca410a99b75d9f71e24179fc23e8bc208e6af.bin

  • Size

    866KB

  • MD5

    cf2e0a1294abe7bba2e134b3a7ec123d

  • SHA1

    efe06de2d8d62fb74a732e2fad10ec6084cc9266

  • SHA256

    cd91974381bd2557f7b980d4592ca410a99b75d9f71e24179fc23e8bc208e6af

  • SHA512

    1e571c2e4a28e8e2201e464b87b883f0b860204a6c77736be72efd43ce61c185a5d48e9b5359b2f86d9a7db308b60cdb69d35135d93102d7b982478bd297f748

  • SSDEEP

    24576:DygmUle+v6lMhbaE0BYR7Zqi/7oUxmyiIJnCzT:WgGvOYQ7MisURBJS

  Score

  10^/10

  redlinedarkgenainfostealerpersistencestealer

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2