Extracted

Extracted

• • Target

    af17367fbcda1f30a6deac6bacfa73f612a4c118994b8ab9ff1e170245fcf00f

  • Size

    894KB

  • MD5

    b52f3f5466708b4ea5af9d195bac123e

  • SHA1

    1fb70805b5f4c2ddce9d5704b72fdc4f91b64a13

  • SHA256

    af17367fbcda1f30a6deac6bacfa73f612a4c118994b8ab9ff1e170245fcf00f

  • SHA512

    02e2fdbaeb746493aeb10b4849d72fed2edef9736ffece84c7c6fbdc24f6b533f9bd353c607dfe0a9be805535441e7174f1afea09b4f50b72d17d220932867d0

  • SSDEEP

    24576:TydDR7QXOaLnZRyfUSE57ZxjB/2YYdMT7Pyq1xJHB4:mdDR7PaLZW2ZLeYYdMT7yoJHB

  Score

  10^/10

  redlinedantegenadiscoveryinfostealerpersistence

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1