Extracted

• • Target

    2322f5781bb89651ba6092ca612968241852557b

  • Size

    242KB

  • MD5

    553cd6c954fd980bd7a6ecee71c308f9

  • SHA1

    2322f5781bb89651ba6092ca612968241852557b

  • SHA256

    64c6995d935467a2d45078af64bcf872bdc0175917df546987a8579e71de2735

  • SHA512

    a9ba74497cce1be981d3010f09540f503d3a41b16c92dff6fb18e00052b5eaa14308cf232e70a28757029599479ddfeea60965f7ea2b594a7a1d650d445f9a15

  • SSDEEP

    6144:vfRDK77E07tfCXaTxophyratd/HAOKF9cx9c:he77E07tfCXLvICxG

  Score

  10^/10

  evasionredline1infostealer

  • Modifies security service

    evasion

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Drops file in Drivers directory

  • Executes dropped EXE

  • Stops running service(s)

    evasion

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2