Extracted

Extracted

• • Target

    9aa38ccf24803ce10c958bb40551d668dbef8b4652aadffa5d1fc87011e66f07

  • Size

    794KB

  • MD5

    20212555963f981fce1c2b9f9b738d8d

  • SHA1

    6e4646e86e473c2e744afc2232da2e617565d05d

  • SHA256

    9aa38ccf24803ce10c958bb40551d668dbef8b4652aadffa5d1fc87011e66f07

  • SHA512

    995a6e8d2c29ec38004a0b0124cb7feafae2d7478d3b3f9da0c926d334fe2b80f9b6dfef65a3200b78066497611e6e5175f33b9e40194575553f78f52e4bb0f2

  • SSDEEP

    12288:ry90utIcf6gc3RsAnncG1xR5vwynP+ZAnetLZbqVKE0WLcGQUyUIZKwPrcHi:ry1ennxRyynWZftd40WoJLKwz/

  Score

  10^/10

  redlinedantegenadiscoveryinfostealerpersistence

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1