Extracted

Extracted

• • Target

    2f789c2ea5567520c4e90ece6735278ecb3939c4e2f889667f061daf72d0e20a.bin

  • Size

    874KB

  • MD5

    2f72b3937b502dc83e42314dded399d9

  • SHA1

    e4f96fa924bd5edb7cd16e8aaf7b2ce04ce68539

  • SHA256

    2f789c2ea5567520c4e90ece6735278ecb3939c4e2f889667f061daf72d0e20a

  • SHA512

    b48ca912c4ee4030fe7ad9d6f48c7e27d01ff75e2b95d45aabcecc2803105aaf7b298454cfaf052321143772eac28f99e3189173e481fdd0002d77890d2c4dc4

  • SSDEEP

    24576:SyO/nfxcUbEBh421LHIYX27RUs9vueSG98tyCHgt:5EfCGED4gLvXaNRueZ9M

  Score

  10^/10

  redlinedarkgenainfostealerpersistencestealer

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2