Extracted

• • Target

    359b94ffcdbf0c25281017d4c13855b6f64814b43f9aaa00930c429328ca246f

  • Size

    708KB

  • MD5

    fe17086a75844f486a61653bfb3b8541

  • SHA1

    3c03377a559be9bdbc1bf1ee3469b43dffcbf42c

  • SHA256

    359b94ffcdbf0c25281017d4c13855b6f64814b43f9aaa00930c429328ca246f

  • SHA512

    06c4eb22a52df90bc23ca826fcce5cc700a58db1fe551a2295ce7324316f841f82bb9fe33fa36bd63557a464764bb3638388c69a088238277f98449ee4515623

  • SSDEEP

    12288:VMrRy90Cy8d7H/yKtXgJSj5jj4zhsQvSUEf/ELZ7HDo:0ymuzqKKJSFj4zh0UIElDDo

  Score

  10^/10

  redlinedarisinfostealerpersistencestealer

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2