Extracted

• • Target

    e284c7dce287a6e32d40d7df2352017d7893e150485ea35f3b9c715758779d27

  • Size

    928KB

  • MD5

    70cb75d4a40cb285ab95e00e8348acfc

  • SHA1

    8572fa8891ea828493b6c230f04e88c91ccd72c0

  • SHA256

    e284c7dce287a6e32d40d7df2352017d7893e150485ea35f3b9c715758779d27

  • SHA512

    5c0c36c74b64590ec68d1a3394933086668298e1c43594288349a35f278cf95d9973a1c435fd12164d2d2e3df5149354ef45f8db6980220efd26f3bd46dac4fc

  • SSDEEP

    24576:Syp3NfPsrDhJrxA7n/L33PzUqXXhBTJs9WSHF8IqJS1q:5p9fP+dJrxo/LHPzVnDlz

  Score

  10^/10

  redlinetuxiuinfostealerpersistence

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1