Extracted

• • Target

    7ad55278a8285dace5bb637348e5990c356a7c35bbcb8e2d53fd3dc64573d4c0.exe

  • Size

    427KB

  • MD5

    c34729173ecc820eb7674431597d78be

  • SHA1

    884f343876a8bb0ebac63c28191c22c6f69590f8

  • SHA256

    7ad55278a8285dace5bb637348e5990c356a7c35bbcb8e2d53fd3dc64573d4c0

  • SHA512

    f9c93a0c6f55217016fe5ba550e9948662901b9240662708ac93074bf9692427b73ce10864927026b118aeb6622a47cfa04976bbc9b482a31aef21a5c96786a0

  • SSDEEP

    3072:yvGyYiSDnt1Et5CmPo8VGAnxoctr6Byd4TUISI:24UCp6n756BmlI

  Score

  10^/10

  persistenceredlinenighinfostealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2behavioral3