Extracted

Extracted

• • Target

    580af04ba9e12421280fef87334ba3ae9dc3d0e3930b8608e266b43d30e31a67

  • Size

    895KB

  • MD5

    142ab39c8912c1e9d2ab6b1170a4e44e

  • SHA1

    03863f3ae665b1dcbfe5d46fa6f3f590813afc0e

  • SHA256

    580af04ba9e12421280fef87334ba3ae9dc3d0e3930b8608e266b43d30e31a67

  • SHA512

    566b1b3a5bcc6dc4b00980d9fb8391177df7409ccbf59bc7020a45c12ba53c379620043285c84140b5bbe41b7b14f99ce512fbe9c4f1385f841cce9e628dcef0

  • SSDEEP

    24576:RyhxBN4j0ZynsR0AntIy4e2oeh+j3XJa55Z0nE:ET4j0ZysTarhqXsbZ0

  Score

  10^/10

  redlinedantegenadiscoveryinfostealerpersistence

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1