Extracted

• • Target

    16c717f61d038c64c95eed31dace8740a06cdfa429f9df78d8e6eaedcb11e116.bin

  • Size

    1.5MB

  • MD5

    564b842e545f05d16fdd01f9661215aa

  • SHA1

    5032d4b545a71e193a2ffa77518f33e27ddd6654

  • SHA256

    16c717f61d038c64c95eed31dace8740a06cdfa429f9df78d8e6eaedcb11e116

  • SHA512

    8c7bcbe7bcff65051d42ef960929df70f95fbfce847899b4910eea11d729460470bfa9b621161bd5205f108f704f17dba671a1925504df221460f62d529cc744

  • SSDEEP

    24576:YyP9mBXltTkh13jq88lDDzzwGyNATThsSLLIBSfCMkJsAlJXGVWMBYBOtvlFI6Wz:fPkozz0FDgAvhd2aBkSAlpGkgtTpW

  Score

  10^/10

  redlinemostinfostealerpersistencestealer

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2