Extracted

• • Target

    a9835342545dccc28b6477fca9416b37258ccaee343e75d1ef828a66e120df6b

  • Size

    1.1MB

  • MD5

    ab731e7d8e334afc7db4eb1a39e2e0a9

  • SHA1

    78ab5a0c98af58f132f0da58cec8774b4778418c

  • SHA256

    a9835342545dccc28b6477fca9416b37258ccaee343e75d1ef828a66e120df6b

  • SHA512

    8946c23fa8da79fb08b05b5eea221efca7743ee04bb183a740fa3a0a73fbe9235f0527f3c52cb4efb9a2f66cf975d59c58edb51a743060218b0fe7c014ec4379

  • SSDEEP

    24576:Hyf/Y8iDZJTIPoLboRsmX18izZGsvGompPf:Sf/Y8iDjIQS18izZGsvG3P

  Score

  10^/10

  redlinelarekinfostealerpersistence

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1