Extracted

Extracted

• • Target

    670594b20b59e6ff351a22a7135a73b48aaad5527c57bc3cec88f6ce77a1fdc9

  • Size

    890KB

  • MD5

    ac382518399402e9d444ba4cd958e378

  • SHA1

    77fc41bcecf258fbb62ac2bda4e754b78b792e17

  • SHA256

    670594b20b59e6ff351a22a7135a73b48aaad5527c57bc3cec88f6ce77a1fdc9

  • SHA512

    6539316d4b77aa6f2d18d87f2b1728d50718bfe8aa05423cac05edda87416f870cff1aa810be529d85b8e96dbbdf5a21c0bba28045061da3d9efc777f7b83efc

  • SSDEEP

    24576:Dy6pESE9VzcnGO2OFngcYrKOu7e+fA5eSVZ:W67nnl2OdgVnmDfA

  Score

  10^/10

  redlinedantegenainfostealerpersistencestealer

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2