Extracted

Extracted

• • Target

    0c03b14f843778ebe345b53f57fe11fd8dd19e40d001179d1ce338a753413f4a

  • Size

    794KB

  • MD5

    3df473b73038d4c3ecc34b061119e4b6

  • SHA1

    8803b3ed47adaa5b938d05e2e9c755263221430f

  • SHA256

    0c03b14f843778ebe345b53f57fe11fd8dd19e40d001179d1ce338a753413f4a

  • SHA512

    a58659314f2b4366b7f68667ae0cd1a7357323c6a4185cfa1d14c857c3775fbdae13b3d35c61019ed71f53bf087178a79b5826bddc23d82ca2e67a7bdf760d9e

  • SSDEEP

    12288:Oy90MHSYAtlwlAOPE+XkAraPWziasCQrTq+2uKB7YtXZy8orpTDN:OytHE+XJraPWziasCQXH/KB7wJqpTDN

  Score

  10^/10

  redlinedorkgenainfostealerpersistencestealer

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2