Extracted

Extracted

• • Target

    295910d2ccdf3cd05350c9cc21f76aa77cdcfdd5ea2d0a15f835d47164adbf94.bin

  • Size

    1.2MB

  • MD5

    12ab1d7773f3f985d9b1ca44fa1f28c9

  • SHA1

    77886891e176fbf171a6d8ffedf17139187a3a98

  • SHA256

    295910d2ccdf3cd05350c9cc21f76aa77cdcfdd5ea2d0a15f835d47164adbf94

  • SHA512

    08b6d6296132c05f75c890b6685a749ff72a2938331185823fe8b372031ecf4a2dc8d8a1990b8707746603c117ac45f4c6fdc8efece219472cced523b8760e3d

  • SSDEEP

    24576:PyWSb2SNg6nDF4uuiI3XuPBCNKaA/yALAyVcmfGONl6gp9gtJUlzAC:aBu6D5f+XSSDA/yxyVVfGOHf9gtC

  Score

  10^/10

  redlinegenalifeinfostealerpersistencestealer

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2