Extracted

Extracted

• • Target

    1fb7b32f74c8ee0174b75e7b256026a3399517c37958bc29e8757412606d6b21

  • Size

    773KB

  • MD5

    aae0ba5fbbcf45050df2c69fa0bc8db4

  • SHA1

    851670da2b72626fd55d3ec93f32f48616bd00ca

  • SHA256

    1fb7b32f74c8ee0174b75e7b256026a3399517c37958bc29e8757412606d6b21

  • SHA512

    4c0c43696828a3085f95cfa689fbe9c764d402569917e54b173e30ffe5a481c71f1fc7d6af8b83fcce3cf2f3030571bc38500bb107f8d12502c51dd20527b434

  • SSDEEP

    24576:RyNq4JPlKMmB8V63POOCWBolrXjmlvThAKKXnnmU:ENq4Bl3CurQoxj4tOnm

  Score

  10^/10

  redlinedantegenainfostealerpersistencestealer

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2