Extracted

Extracted

• • Target

    e441f933913046fc88f4c8f04846eda2d284af55f62db3796c59d069476255c5.bin

  • Size

    774KB

  • MD5

    79804c9c15f3a81aaf89d493adc8447c

  • SHA1

    a290ba70db16c9671832f20adbbdd76b42751654

  • SHA256

    e441f933913046fc88f4c8f04846eda2d284af55f62db3796c59d069476255c5

  • SHA512

    4bc1a89fae2605ceae4bb02d9d41982a1c58102a4585f544b275967dd0580b8771a65f48e1ea9f12d9ea8212446815697ff84de2c01f9da4db0c43f16944475f

  • SSDEEP

    12288:Yy90XeYqD//s2toTNjhKUlhC2NfYF0pkO6Hecw1rZOma9CEJOjD:YyyBUiRhK2hXc7xw1rZvn

  Score

  10^/10

  redlinedarkgenainfostealerpersistencestealer

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2