Extracted

• • Target

    0f4c5547a09a7131c7e1e855f1e5469779e8a2242d9a581eee717906fd4d69d8

  • Size

    643KB

  • MD5

    23693d58857ce79fbb62ad6e1590dabd

  • SHA1

    d31d7b29330c0b864f908604eb73824d23642dc6

  • SHA256

    0f4c5547a09a7131c7e1e855f1e5469779e8a2242d9a581eee717906fd4d69d8

  • SHA512

    5d07c656f8de2fc0aaeaadfc01d3b38ef724fecf2dc9dd5427ab6a28d13f45dbd4adb0c30cd508f29ced700e3b3eda54540849ef2b63c6a288726e3914f98979

  • SSDEEP

    12288:vMr3y90nmZ4qQIcn+o5JachYZ3R8keACR966IFyOVMLlzL1fS:UyhXc+o5scEh8X66uyO0L1q

  Score

  10^/10

  redlinedarminfostealerpersistencestealer

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2