Extracted

Extracted

• • Target

    b49f21e73a9371b97ee689c1c0f2b403cf6faa1633071f097dfc7fc91caaa072

  • Size

    890KB

  • MD5

    b8136b372c89d71781a271582fbacb3a

  • SHA1

    a5e68997978907379c1423a838b7e499dd77060c

  • SHA256

    b49f21e73a9371b97ee689c1c0f2b403cf6faa1633071f097dfc7fc91caaa072

  • SHA512

    e5d82a0330961c7e54549257f28c3ddaf134a8de64580cc9ade9b7eb90735814d1455d7f234dcb7a1d573693c28b277cf02c1888d09fb8e9385e52f9281be2ca

  • SSDEEP

    24576:QyKWk2TmJX4n7RnS+RPXm2dTbgIf9V89IaeqmyPA:XKNp47wO/rf9C9frmy

  Score

  10^/10

  redlinedantegenainfostealerpersistence

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Detects executables packed with ConfuserEx Mod

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1