Extracted

• • Target

    fa36c663b4f46c3fa6168c3cb3f9f1f1ec6426d5a7e4c5feebec7a560717caf4

  • Size

    1.5MB

  • MD5

    8c8cc295dff3f25bca36eb8ea3268dbe

  • SHA1

    7cc1270984215450eacb2b599a1a09982ef03b76

  • SHA256

    fa36c663b4f46c3fa6168c3cb3f9f1f1ec6426d5a7e4c5feebec7a560717caf4

  • SHA512

    ee0896b9da6e45b033c06b9d1cccb174edaf9213153e05198737c2b78098ad98a65348d1ad9740b70d945adf4ada3343a21715997c753ff96c72a6c48458ace3

  • SSDEEP

    24576:hyhvTqNQhMs4r/NrZQKPP4Ve8WZ9VbaAT+azEtxnjRi3zQXNusg/yi:UJ9ys4r1rVPPOJWbUpTDjRikX5ga

  Score

  10^/10

  persistenceredlinegigantinfostealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2