Extracted

• • Target

    395708461eca1d1c68ddc3439c53cf311eedd92d3aab97060fc1eed799e7b789

  • Size

    644KB

  • MD5

    f664295ceaa29123ceb02189f5ff398f

  • SHA1

    98469b179fa4c29e403a2c0af7211554216e9791

  • SHA256

    395708461eca1d1c68ddc3439c53cf311eedd92d3aab97060fc1eed799e7b789

  • SHA512

    5788f9c00cf4c1f79db5428145bf5f6c6b977d6955b6d387b8fb71c9bd35d060b536481fad7254bd1bafabed8d39fb59f56fbc99427258da45b15cd9baa14199

  • SSDEEP

    12288:lMrFy904+TLSiMUrr9g86OE0CmbAhzX2svaKhSx7eqamb7hWwjD:Uy9er9g86OJUXzvthSx7eqaq7hWwn

  Score

  10^/10

  redlinedarminfostealerpersistencestealer

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2