Extracted

Extracted

• • Target

    0bdb02f37b7b7cfd3e303779cd3d4199c54b268fb9294363e81e44ff6cbbf969.bin

  • Size

    1.2MB

  • MD5

    0f5f2551642ae2b534ec800aac04c028

  • SHA1

    021ae956a1beacf4619f0d35ec96e6c60d757336

  • SHA256

    0bdb02f37b7b7cfd3e303779cd3d4199c54b268fb9294363e81e44ff6cbbf969

  • SHA512

    13bee95c7218010d03ce63091afe93c3103a4e755a479b2477187d1a514e6eab2344efc859871badd6bc1608163e7413cd8288ee5e3151ae01da9e3c268c5dc4

  • SSDEEP

    24576:7yCU2225pdBcmt9KRdke42WF0vgzl8RID:uFLK2l4jF+

  Score

  10^/10

  redlinegenalifeinfostealerpersistencestealer

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2