Extracted

Extracted

• • Target

    e225104547f7cd3e002ae69ac88c2ff8515afd54a835f9d6d1bdb528d32f50cdN.exe

  • Size

    773KB

  • MD5

    4294bf15de1e13315f9cc13f9365b2c0

  • SHA1

    6009cc4a472a8011e2d69ec18cc8d9d7ab26a2cc

  • SHA256

    e225104547f7cd3e002ae69ac88c2ff8515afd54a835f9d6d1bdb528d32f50cd

  • SHA512

    6bdc2a28016690e9a68590ae16e443067261b3d91ea863a3c5614f5e3f59f6d604ec085405d2fd72ae5f1cafff736fddbe313a3a299ffa05a25c7b5a14acc87c

  • SSDEEP

    12288:Wy90Td+yErsNNoMvHZ/Tl9gOxJBkneTWyLnPscUo/Pb4JVgCkxk/0JXllSxRiNlU:WyzINNlHZtxrZsQHb86W

  Score

  10^/10

  redlinedantegenadiscoveryinfostealerpersistence

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1