Extracted

Extracted

• • Target

    856494eaea6f98e8b8b57f40f07f37963cb41b969e63affee8a6bed70b4db15c

  • Size

    892KB

  • MD5

    bda5619521302b7d977e5fd8497d5347

  • SHA1

    7935dd9262db1b01479ceac7d2c289b7b717db2b

  • SHA256

    856494eaea6f98e8b8b57f40f07f37963cb41b969e63affee8a6bed70b4db15c

  • SHA512

    944482f87f7221f75f9d2356107b1ca8a06bc18c6626a7c36f888285342e685fa5a87caf238e4f281bf3b986cf5dcaa358d82f3749a0b23dd3573e31d60cf2bf

  • SSDEEP

    12288:/y90p8ObVVJSCuLHk8J93FJ9TqRidGGNikyC2e2N/pRvolJzPCrDjKeYyq:/yZ2VPSCuFZdVDwrQ5PCrDOeNq

  Score

  10^/10

  redlinedankogenadiscoveryinfostealerpersistence

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1