Extracted

Extracted

• • Target

    5013cfab75c8cfd986b3ab4de5c346c47f7d40736a6cd82943ec4cf5f8cdee22

  • Size

    851KB

  • MD5

    97885e98bb6747d8658cdaf2f2884c78

  • SHA1

    497588757eee774812a3fbb506a60d0354f3de72

  • SHA256

    5013cfab75c8cfd986b3ab4de5c346c47f7d40736a6cd82943ec4cf5f8cdee22

  • SHA512

    9642e5e5d63bf2ceba8d74a5af747704929c54249c44ef429a4e40ece20082d9cc4f66dcdaa49a366bf5f18702161e0a1e64d61bd22da39eb792d379c2bdbb01

  • SSDEEP

    24576:wyeANZgOrDx9usSCbiTxnnb4EX372YCoqpp:3vTgOx9oVn8g7v6p

  Score

  10^/10

  redlinedantegenadiscoveryinfostealerpersistence

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1