Extracted

Extracted

• • Target

    f68d6cb535e5147094dbdd414898898444284288d04acc4e477d8bce5a929006

  • Size

    794KB

  • MD5

    f2a151c4b095000d4c6d1a0c276eec63

  • SHA1

    74309b9b8e23c32c68567f047f08848948c8226b

  • SHA256

    f68d6cb535e5147094dbdd414898898444284288d04acc4e477d8bce5a929006

  • SHA512

    7212435dea8950b02f8caaeee8fe457f8857395a6be799dfaba2b04fd0c9d1a26b0263e1f93e6919dbdc44a06d34967e3b95a2e46f54c80b8c229bcbe1836454

  • SSDEEP

    12288:Xy90o5fjM8sqZaYn3NYinn8DUrR5jwF7Pehwnep2zH98uIEqqSJaZAyXMF:Xy7LShiddnBReF72hPp2zagPcKn8F

  Score

  10^/10

  redlinedantegenadiscoveryinfostealerpersistence

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1