Extracted

• • Target

    cd7d898a13d74fb5d08840c2c49e6ad2b9a0af5e86d8fc96c480dce5797d704a

  • Size

    1.5MB

  • MD5

    83a944e4466559fe02adc1fce5ba69c7

  • SHA1

    4b52b8b1ab4c525a9d5fd9ad8127f5ac12d6bb62

  • SHA256

    cd7d898a13d74fb5d08840c2c49e6ad2b9a0af5e86d8fc96c480dce5797d704a

  • SHA512

    325cb8aa7b527288ce9b8a27d79a1dd1e98cfab0ef56233a722d62f733b1f37ddb287e1940dc89716ea7f40bd8920b6399956e6e969cbce3042b63984fcef510

  • SSDEEP

    24576:eyGUpcIUOcCC20KQI5UNH40kiBZpDKxEr0tptyusfVn5r2:tGU6OERKDIY4+e4rgV

  Score

  10^/10

  redlinegigantinfostealerpersistence

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1