Extracted

Extracted

• • Target

    281dec2c157b3e400032f806fe1e4493a1a84f5f6a2dc1c2efb6e543c46a190f.bin

  • Size

    787KB

  • MD5

    9a75886a39eea67cb758e1411ad55749

  • SHA1

    f26ee6ba57d07598d280cf28aa742d1b17bae40a

  • SHA256

    281dec2c157b3e400032f806fe1e4493a1a84f5f6a2dc1c2efb6e543c46a190f

  • SHA512

    47a000b967b68eed9a0fb06587860030840f7d1d3b577ae761f0af2262e155c7c32deb657491ada932bf639827433c17b766ed8b153b7bb79dec624047a02a4f

  • SSDEEP

    12288:+y90OrYKXrNJuYYBRQCwUteQzFCoIsZJAyaskAR1ID62sT+T4xhjhdg4ysGbp+zd:+y9rrpJuYGRbh3IfXuN2rTmTWuay

  Score

  10^/10

  redlinedarkgenainfostealerpersistencestealer

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2