Extracted

Extracted

• • Target

    79d0d71beae6061be173c5764e0f8f3992d56a1088aa03b6a7f7e0fb3d8f58e5

  • Size

    794KB

  • MD5

    ed66cecb476e303afe8fb8bfb42454d5

  • SHA1

    04db8d96824a6a66512baabcb19fad07fcb198f5

  • SHA256

    79d0d71beae6061be173c5764e0f8f3992d56a1088aa03b6a7f7e0fb3d8f58e5

  • SHA512

    5dcb4538cf6235a0e11abee0ccd8a05376e6667c9762e971ab42954e2c3b740293c779746127afa851897b458e334396da54dc323c0f2cf529f0b537ebe32977

  • SSDEEP

    12288:oy90ZJl/+d+0aH9sYGgPkATaPp6iKsCQr8vIzQLWmDm5iYseC:oys//lJH6gPJTaPp6iKsCQkfWsm55C

  Score

  10^/10

  redlinedorkgenadiscoveryinfostealerpersistence

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1