Extracted

Extracted

• • Target

    e334bb349157e5788493a601581ef3bfb32e75cd6d21c1947df37240a174b4bc

  • Size

    774KB

  • MD5

    6ac72d69c0050628067fb5ee48815f75

  • SHA1

    aba8f1713144178b1593f4b5d3f7c4a0ecd02a7e

  • SHA256

    e334bb349157e5788493a601581ef3bfb32e75cd6d21c1947df37240a174b4bc

  • SHA512

    56fcdb0cd728bc702e96801d6d2fcd336bd9fac86d9dbf775e7510cf3588614da198b0ade80444ac2d97485a182cc4d24540d4e3962184cbc6ec469ecc911c3b

  • SSDEEP

    24576:FyEYAxmFvPkOTMBYD8X1ivwzJVSroGO/H:gvCmbOYy1i4zJVSrod

  Score

  10^/10

  redlinedantegenainfostealerpersistencestealer

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2