Extracted

Extracted

• • Target

    0d1e12c521a49609e3e84ec68cbe26ad3dc54b738e7271b2432aaff25d21544c.bin

  • Size

    1.2MB

  • MD5

    d31e9d275cb8884c0d7110993acc36f1

  • SHA1

    0c039017ecdfa11854198d67b1b5360536be511f

  • SHA256

    0d1e12c521a49609e3e84ec68cbe26ad3dc54b738e7271b2432aaff25d21544c

  • SHA512

    83d71371b3e55b7636db7233d5a8d231bc2de5e40e1b70ab275d6e54d9ea3ff0ea769bf173808c529c2b486fab1e379c31ad3881f2f9863c16e7eeba0b8037a2

  • SSDEEP

    24576:Hy8JCb627TEB1NCwfoKhy7/a8Gp7IE/jFYoELTeiFlZUS:S0CbR7YBTCI3yCvp757FYhTeUT

  Score

  10^/10

  redlinegenalifeinfostealerpersistencestealer

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2