Extracted

• • Target

    03505e486ddca50ca61c00606ced77cc5abbba42bb696243be512efd3c59c7c5.bin.bin

  • Size

    1.5MB

  • MD5

    dbc7f3dddfbf1b53f5d89cad9a214000

  • SHA1

    319f066b43933f3de580cdf9f542268e1e70f87b

  • SHA256

    03505e486ddca50ca61c00606ced77cc5abbba42bb696243be512efd3c59c7c5

  • SHA512

    c04bc19a5a3c83418b40daf910f8052b410b7fe72786cd0fb692fb524326e5ae3a2e3567a143b4749e6391d85afeeed28980db99fc07a8599a66003ea4ab9c7b

  • SSDEEP

    24576:cyr//pQTAgHR6uZfAgvw09G1jHY0LdfYWZ/dPPW54paBhFo+fxbTZS:LrHCPR6u3w0E17xmG+JTfNZ

  Score

  10^/10

  redlinemostinfostealerpersistencestealer

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2