Extracted

Extracted

• • Target

    12d85cdc49561a8420fdcf583d64159d8ef4cb0aedc2c7ccc7b1436a1b1d6514.bin

  • Size

    866KB

  • MD5

    fb0d712bdc57af5d633a86f5871b4ab0

  • SHA1

    8fe9b17d1fddb0f12a2d72be6b329e9cdd0493f3

  • SHA256

    12d85cdc49561a8420fdcf583d64159d8ef4cb0aedc2c7ccc7b1436a1b1d6514

  • SHA512

    3bf1c733a7c760307092b5ffbdf0e1f207745c2d3f37f9bc8c4e35da0da2f74b0d4742c4c33a2fef947b5e7408fea38f7e7e581d19c9c183ff1474975c7c175f

  • SSDEEP

    24576:UyGDldzz9KrfY/XGaa9zc9ZDyEl/lqwN/7:jixgE/RV9lyEV5

  Score

  10^/10

  redlinedarkgenainfostealerpersistencestealer

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2