Extracted

Extracted

• • Target

    1b59c5ba6e7121d6a66918fb3dee95796e81f4d23b8b2d270d1ca52d407ae348N

  • Size

    570KB

  • MD5

    783b59b4f68f64550dec655a90bf90b0

  • SHA1

    5d74ab113b3dd626ab139052ba1f1f620f99bb67

  • SHA256

    1b59c5ba6e7121d6a66918fb3dee95796e81f4d23b8b2d270d1ca52d407ae348

  • SHA512

    89b4a600b7967e72f80d9a75bb7086d94fa73dbe31680293a3d5ab4ea7a563b8b08987b2b5c505ab1d333831d6f1a18ac85c0562d490135ab83015c6e17c3212

  • SSDEEP

    12288:sy90OlbJ4z0KOW9l2gUzaJz2qyApxbrhr14TjvQhT6QA:sy14z02chz8Cq1zj4TST2

  Score

  10^/10

  redlinedankogenadiscoveryinfostealerpersistence

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1