Extracted

• • Target

    ProtonVPN.exe

  • Size

    3.4MB

  • MD5

    f900e0fa80afacf148edde94dc886426

  • SHA1

    d44fc8bbd2307358a3a238426f577d2954626c49

  • SHA256

    f91fa2060c2f01f47c27a87ec0e64c02e5f9bc25e645bd5ca83c3c06b8ab63bf

  • SHA512

    d184380a2c1a3355260b91b6b88bea392f2f9dcd9bb8e2a19c2397ec5c450eef8a9f9a213142e0a1c2c9a49f904aecf291660dbf002905f094f1ba7ca61279d3

  • SSDEEP

    98304:S9phoap/5L59WJUNw4U2xp3Qf/yaxP/WxCnNCp:wpe2/5L5kExKqCsCN8

  Score

  10^/10

  redlineinfostealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Suspicious use of SetThreadContext

  behavioral1behavioral2