Extracted

• • Target

    531a4fa092db05115532b13d0a71412a1227fbd0cc5338ae1eed38de096b6320

  • Size

    480KB

  • MD5

    7cd19f520a91f59277b37d4baa0aaf74

  • SHA1

    87b29a832f3e55a9786dc130d642fda4bca2e615

  • SHA256

    531a4fa092db05115532b13d0a71412a1227fbd0cc5338ae1eed38de096b6320

  • SHA512

    59155067485e9d75cf9de28cf2c4d80ad0952ff9d48d7413b9fc6d5ff3ca18440a54fc91138964e701f1f83d255e987b8492a30298ee71ae024ba74f80f8efd7

  • SSDEEP

    12288:IMr6y90lN+reTk6ta0AdoaDVk/JwXk4hfhFbC3GJii9DY/:CyI+X0aLepwXk4dvbAi9Y/

  Score

  10^/10

  redlinedarisinfostealerpersistencestealer

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2