Extracted

Extracted

• • Target

    2297d297a48b919c235b9b36a058188dde1d6b45339038b6dc4b59a3ffd9b366.bin

  • Size

    786KB

  • MD5

    1ee15deeca0a0959a64987350223d0dd

  • SHA1

    f9c8c6b75e89869b3644b712b02bee6b78e4f8e7

  • SHA256

    2297d297a48b919c235b9b36a058188dde1d6b45339038b6dc4b59a3ffd9b366

  • SHA512

    b823ad29c363cdd73369b17c65a2e0561267bb5c07f89b3bc0a47ba7aa77a6bdbb6a2ca4a55a18de74c91c72be5edceae570b697a2c1fbdd6fe366c19cd68d1b

  • SSDEEP

    12288:Zy901FDYRpBmdsCVBjBQeFK4I3ZJRyaskA+1+D6LsH+9TtaqO1G0aTLtCBJFo7p:Zy3BgjiYXIpXnnL/98aTLtCLwp

  Score

  10^/10

  redlinedarkgenainfostealerpersistencestealer

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2