Extracted

• • Target

    4b14a7d28f349ce76113118926e4d3e4ad479cb2ae9170fa3839eaaa94d63139.bin

  • Size

    1.4MB

  • MD5

    8f31ea0435a93b38a18abf0fd6979d4f

  • SHA1

    dbccdb84e92b5ad100107dc851f566e2e0d3fcf7

  • SHA256

    4b14a7d28f349ce76113118926e4d3e4ad479cb2ae9170fa3839eaaa94d63139

  • SHA512

    da7c98948b4ce316239755a7979f30674be41074b20d7e560c870969b573aaa5aa05d87380b1e10e91b802c6143346f0f892695d8b34ee1bcfd4236a2cb725c9

  • SSDEEP

    24576:HyfvQ3EjX1XFBbqRjWRUJgNfPk38zI1YOmbsLMjXO0M1Edp8v:SfX1XFBbkCRffs3CI1Y3bsL0Mg

  Score

  10^/10

  redlinemostinfostealerpersistencestealer

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2