Extracted

• • Target

    513d7e79ae99396b9d8a79f1af172929a020785510ab876afb0c25a547533354.bin

  • Size

    1.5MB

  • MD5

    ada40c4d94d6bf556255651b5ce72f7f

  • SHA1

    2da79c523cab8a492434f7af0783b49fed3a859e

  • SHA256

    513d7e79ae99396b9d8a79f1af172929a020785510ab876afb0c25a547533354

  • SHA512

    5b4ba6d9f5f6b8cfa18020b431feacbe11522419ccee5a6b55ba8726dad82800dd291255f30be04dd2e0790c21166fa80401437dbb626b89f355604365801101

  • SSDEEP

    24576:0y0NCFn7B0s0+VrbjML/Sv9Nd6T0hSnlvDWF9dJSG/i/Nk8n0AaZPGD/ytJy:D0wNVtDMy9Nd6AhSnlvDWhTaFk80AaZL

  Score

  10^/10

  redlinemostinfostealerpersistencestealer

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2