Extracted

Extracted

• • Target

    03bece8cef42e09db6b8fd7c2b7654d490583b4837a7d414a4f64da519ea7eae.exe

  • Size

    570KB

  • MD5

    f27e976dbe07c14dba6191c821da9064

  • SHA1

    1e5b87fcacb60a4dcbdd2c9adb981d47fd2c1624

  • SHA256

    03bece8cef42e09db6b8fd7c2b7654d490583b4837a7d414a4f64da519ea7eae

  • SHA512

    32609f8c73184fb4e80e87948918e9c32950612b8584c013ed2d86580541a8865515b6af0967884ab0e497b3a28d7fb5d5d0f8aaadb62e65aa62c8b00627de78

  • SSDEEP

    12288:xy90SQ0dRTmPHSvAbI/9/a74L7KvF0tYBwX4Ng/dVh:xylQuRTeSobOCFoz4eVh

  Score

  10^/10

  redlinedantegenadiscoveryinfostealerpersistence

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1