Extracted

• • Target

    3ae6e72641f2326727f8709da58f11cb7ccb3ddb31f4f23670aa94d3fa1cda1b

  • Size

    939KB

  • MD5

    8c0af99c88189da1b23b22e0cced751a

  • SHA1

    231fa5d4a832172c2fb2f99efd2a0f699f5f58d1

  • SHA256

    3ae6e72641f2326727f8709da58f11cb7ccb3ddb31f4f23670aa94d3fa1cda1b

  • SHA512

    681485764cf674bed3bfafe247c7f128e535a968e1937e0eaa43a37b6b2cd11bc19bcf60f5b2b7b2b94979150b6dac06a384dc9e378ed49061c7b19634526390

  • SSDEEP

    12288:UMrwy90mDSFxCFHu/uVK/DuJoa9J8rJ+8K5KAVYhhZcHBb0aMyvoGt4g+d0KfQdE:kyjg2H8mMG9J8rJu5KA28vZvmdvL

  Score

  10^/10

  redlinetuxiuinfostealerpersistence

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1