Extracted

• • Target

    0742df311ff410c039367a10a666119f420e58134fc7b2bb956c691e74f6af33.bin.bin

  • Size

    1.5MB

  • MD5

    2c207d98b3aa5d45c10e031b93004941

  • SHA1

    97c5f5de4d19cae8b0833e0a0ef50881efac4a86

  • SHA256

    0742df311ff410c039367a10a666119f420e58134fc7b2bb956c691e74f6af33

  • SHA512

    309100a9069c2a18f3f30f589fd6db0e5ef28486d7293b9ff42bde1766ae8e17d0e9bdf9de42a6dcfa65c827e64ddbb64cc359b420901af483212e37780e0fdb

  • SSDEEP

    24576:SyOT8eilGcBNJsgO5QIcPrUILw/qLob93XZbmIgsUz69FyxMRvIKOR2hiljP5Foe:52BiTZ3PDk/qLqHZbZgsUeSQOMhiljIK

  Score

  10^/10

  redlinemostinfostealerpersistencestealer

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2