Extracted

• • Target

    13e23e9892a39d9236268e7aab6a14b4c401f5c65f8ac50ebb4cfcc840c51724

  • Size

    1.1MB

  • MD5

    803297b6a63526e4bedbac30ba928e8b

  • SHA1

    914daa56d75292c7266c85e9e16ea4f5d2b47dfe

  • SHA256

    13e23e9892a39d9236268e7aab6a14b4c401f5c65f8ac50ebb4cfcc840c51724

  • SHA512

    f6025162c099e63350cb7e745151ecc732e488f48ca4f131aa0ff0e423aaebace3141ea137c74488ded9e3c8d5bccd02f69ead5a05bc722cb8acf7e2cdbb534f

  • SSDEEP

    24576:KyNhK7vLipDu7NQsuWeIren25A7xZ4TPiravxO:RNhJ3UMxZ4cY

  Score

  10^/10

  redlinelarekinfostealerpersistence

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1