Extracted

Extracted

• • Target

    0212bc339310ba9a92cdf372c5fca4a2541bbfa0c713314f2cdc4ad8fd3e65f0

  • Size

    851KB

  • MD5

    de383be8197ac97d79b07722023c9119

  • SHA1

    99fa3a7a4693579fc0e4108367eb30110f8b6cd7

  • SHA256

    0212bc339310ba9a92cdf372c5fca4a2541bbfa0c713314f2cdc4ad8fd3e65f0

  • SHA512

    74a5a1eb43515873f2baa2deaded2cec3348c3432643de2d03f5afc3c345422a9dff3c17f9b321beee859898a485c928114bde97e6c078c6244bf9c2ebad4968

  • SSDEEP

    12288:Ry901a8cMx33qY0RV825mPHSvA9+/a/ao4/7Kv+MgvarYScGlkaUCjGOWrx4ZcVG:Ryql/JI55qSo9Lb+/valcGlkpCEecLI

  Score

  10^/10

  redlinedantegenadiscoveryinfostealerpersistence

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1