Extracted

Extracted

• • Target

    df76967ec96643733c871a6b3df8a7d9f8b185ebdfc4162c1114c382d3ccd485.bin

  • Size

    1.2MB

  • MD5

    3010ca9de768f5836a2eb9586b2b109b

  • SHA1

    12dd5558b5f12b4cda44382093575320481ccace

  • SHA256

    df76967ec96643733c871a6b3df8a7d9f8b185ebdfc4162c1114c382d3ccd485

  • SHA512

    3500a892f3e882365de55eeeb5e48b0fd9b1de009fb9085592abfb209487302e71a1eed85b4cfc8be7e3026a5c93686d88e105db39a373ef7e5fb3acaaf5cb75

  • SSDEEP

    24576:Ky/pKj7H29pYGL09agDjmukGsIyXraYjegac5UF63ZhU+DjFSLhWYX9:RxSb23vL0sgDaukXlXzKgaIeomiELJ

  Score

  10^/10

  redlinegenalifeinfostealerpersistencestealer

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2