Extracted

• • Target

    52fe387f2a61b46e337a863669d80d34d343f4f46f2b41167cee09a3759604a9

  • Size

    587KB

  • MD5

    08fe701adcd51f0fc850c5a8ad0bdeea

  • SHA1

    beded60d590d4f4b737127dda2e9d6c034f82fed

  • SHA256

    52fe387f2a61b46e337a863669d80d34d343f4f46f2b41167cee09a3759604a9

  • SHA512

    72e6666c3e361aa1eac920b5ff27cab033f303433b71890bd8f635be8beb86a58a76c17220025ec541b83f16487a76491a44bc87bcbd532e372f9ebecfe9b89b

  • SSDEEP

    12288:5MrXy90BGCYgSJGQY1BApUBTBy/xWoXrWbPVisPqqpPL4ZuQe6d2c:myDg65aBFBTBy/xWXDdpPLxQ/dT

  Score

  10^/10

  redlinedarisinfostealerpersistencestealer

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2