Extracted

• • Target

    6a6285200e43d42f1bd0afdbf85757bf7f2bde9288123f9e0091b95cb273479f.bin

  • Size

    1.5MB

  • MD5

    afee4140b2a2e4bbf6597532ade8c65a

  • SHA1

    f97928f45828ec20545f32de8e881538458e4a1f

  • SHA256

    6a6285200e43d42f1bd0afdbf85757bf7f2bde9288123f9e0091b95cb273479f

  • SHA512

    a858eb2ed2ef3b65a41c2b463fc23b9ce264902d6d182cabb48631bf6699b799729fd2ded343dd46a488c1dd2e6b5150728a2aee1f08de25dc53b43b98b3bff1

  • SSDEEP

    24576:myUdPMrsbvMuy3CbH6vhGlIb+XsTz6SZ/dZFfmeddKemqu3qd6aKabACUC:1UxMIb0k6vV+XsX3Vn1dQqu3qkvanU

  Score

  10^/10

  redlinemostinfostealerpersistencestealer

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2