Extracted

Extracted

• • Target

    1d53e9ffce0a07dac0c5d78b6f85f736ae2cf90d680583d7a7e7a4d477deaac7

  • Size

    570KB

  • MD5

    6c15f3d62b6ad8a4907113c5cdad57d6

  • SHA1

    f67031ef6ef5af1d8c97ec147a9c09b508173d4d

  • SHA256

    1d53e9ffce0a07dac0c5d78b6f85f736ae2cf90d680583d7a7e7a4d477deaac7

  • SHA512

    640e99c4561a80a62dfe745c0690b2437c9a218d4172bebe88aa5ae812c85b77a3c12af7c953d16b4b901692827f9ba5d80a3ec5f91cdc8f0f2ba7f82866880c

  • SSDEEP

    12288:cy90ZpRE0CATmPzSvA3I/L/aJ4w7Kv8eVah1FarJFtV2:cymsVATGSo3Md8OahDaNF/2

  Score

  10^/10

  redlinedantegenadiscoveryinfostealerpersistence

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1