Extracted

Extracted

• • Target

    e2c95944409b65b97afc7615b3e7f149c7b1c4d59b7943623222c10c455014b4.bin

  • Size

    782KB

  • MD5

    2f822a528c028738f05cde89e11c2eb4

  • SHA1

    ebd989f5ff491ab8812480683e0c5281c59549b5

  • SHA256

    e2c95944409b65b97afc7615b3e7f149c7b1c4d59b7943623222c10c455014b4

  • SHA512

    fade7a2ba0bca41717e4a7bfbffab9cc4d655904bed1c2b7099c4445ee8452d47397b0b83467d502aa32f3ecaa11176f9ec83a33e62d12a9974af6510a4d2630

  • SSDEEP

    24576:Cynhv1usoiTVSvtinXUmZPaFLg9wQgnrN:phv1T4V81Zi5l

  Score

  10^/10

  redlinedarkgenainfostealerpersistencestealer

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2