Extracted

Extracted

• • Target

    9d4c4687546c59711b3d0f302015b3c608684fd5969726328191ed358e55a269

  • Size

    794KB

  • MD5

    c9e558a968ff1a7983d590762cc49623

  • SHA1

    c263f4da14d4b5ec3f51393c3cacc0aed9cf18f0

  • SHA256

    9d4c4687546c59711b3d0f302015b3c608684fd5969726328191ed358e55a269

  • SHA512

    b497c56b2fb9d478e80af3108953ca46eaf14eb531dfe247569d626d21f7313ce31dac772c4c5b815871dd3eaeb25d89c08b216e591496493d1f2a65bba95ca9

  • SSDEEP

    12288:Py90VbWcDdqo6aISxFqH0ATrYk8593FJHfiTidGpNMTy2+9JlrEy//LPkDRll:PyC9DJxoH0ATMn3xsBDKPl

  Score

  10^/10

  redlinedankogenadiscoveryinfostealerpersistence

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1