Extracted

Extracted

• • Target

    df498a1f4ccd74e785e063eece2a34b3d688c90e7a1bef2d446146d48b9209ee.bin

  • Size

    1.2MB

  • MD5

    929f8e22f5ed59782e1ff11e8d04c937

  • SHA1

    4e6f17fbf3321b0bcbf7890df51cd51c587b6b89

  • SHA256

    df498a1f4ccd74e785e063eece2a34b3d688c90e7a1bef2d446146d48b9209ee

  • SHA512

    8c18568824f0ea1cbf17ed7389fa330192257faba7ee10da6fca44810579d99b64ce5082df69da5c0e63c16ff685236a8effdd4294b98b7e2b4de2c9da85b899

  • SSDEEP

    24576:8yct4quVNA7D5ys0qjIlIT53h9AfQ5JVAgz/1MOyFMe90r5e3tdOSknAU8:rcVByNmF5zmOJAz3enAU

  Score

  10^/10

  redlinegenalifeinfostealerpersistencestealer

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2