Extracted

Extracted

• • Target

    3994a93685e9c77df5404ad6dfc06c559cb7e2017f6763d6685942ce7cedea73.exe

  • Size

    569KB

  • MD5

    a360b55405c1988ea4ed3bd10454be3d

  • SHA1

    98604119d1b77ca2672d92d72a24a4e4974d0fba

  • SHA256

    3994a93685e9c77df5404ad6dfc06c559cb7e2017f6763d6685942ce7cedea73

  • SHA512

    27a1f686d9dc2fcfb07f8bcd35b15e6e9aecfeac1bb629d24c30c82095e2f8ccf8c450d0c408768f825116827ec09d83872717a7a31ad21ce05963d93627d711

  • SSDEEP

    12288:5y90jAmCH4vGgA3Y8FdjPhOKkD0BsKxuL0o5XkOiwk7d5:5yqlCYvnkPhOKfBbVSX/itd5

  Score

  10^/10

  redlinedantegenadiscoveryinfostealerpersistence

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1