Extracted

Extracted

• • Target

    a41134e05c89c8151e7688e5687dd5dd25b0b76213da935073cb94070b585fc6

  • Size

    849KB

  • MD5

    6eefe246e611115d1cf53786cab9c2d6

  • SHA1

    13e083e45a67636851bfaeeb96cb6491097f77ad

  • SHA256

    a41134e05c89c8151e7688e5687dd5dd25b0b76213da935073cb94070b585fc6

  • SHA512

    3f19acf6a0b7bfd0e0361490a3d8d4bea3cdb1d22e1b778fd885a92cc0d0ae31de40d44c31e6fc1e7c7359e26197dfb8b93887a39fa1f305d389396ae83f9ad5

  • SSDEEP

    12288:7y90YLE9eKFltCYi/mZjkAGT9d3P8OSkDTBl0gdy015XwVVh4BEO0RqmojrokT:7y5KRZjA/P8OSsBug3Xwn6B6Rqm4v

  Score

  10^/10

  redlinedantegenadiscoveryinfostealerpersistence

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1