Extracted

Extracted

• • Target

    64e6212500724042e98edd7ecf7e376c9bff532a4befbf8d8e6400ab2f4b8a1c.bin

  • Size

    786KB

  • MD5

    2591b97006a4d36ccb4d41d6155a8123

  • SHA1

    fc7788662f6dc626331181e882e94cc2f02503be

  • SHA256

    64e6212500724042e98edd7ecf7e376c9bff532a4befbf8d8e6400ab2f4b8a1c

  • SHA512

    a68e40428b63919c271defb9d68aa8e20d978e4201450affd4d9e3c481b621ce3c145121521c0859e4e475783cf043c8c95ba8817dc56bab7e0730762b8880dd

  • SSDEEP

    12288:Ey90O50uuGlnG9oQsFXcI5ZJSyaskAQ1vD6/ss+isd5INfQ6KJX4g2j7cJA00:Eyj5j/2VuMIwX1M/cbQfQ6kX4g2s200

  Score

  10^/10

  redlinedarkgenainfostealerpersistencestealer

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2