Extracted

• • Target

    50028e44ebdafee95a39dc61d109633ffb42e991d336ac9245b8900d4a7793a4

  • Size

    619KB

  • MD5

    c3ca72e5c4faa2dc9bf4dff55523f37b

  • SHA1

    fb20e8f314f7e3d22b76ccb0e8f9a81ed779fc0d

  • SHA256

    50028e44ebdafee95a39dc61d109633ffb42e991d336ac9245b8900d4a7793a4

  • SHA512

    5f01871c5a740e8511adceae768f2fd95de1e83dad55e60ac349705e616d327c68fe01e58073fe5ff1ed68474fc923800209f5fed82b8bcd1d3d49d99c7dee8f

  • SSDEEP

    12288:KMr5y90iR/Sj9y+DhMBuTwgl5ZdokwZ7/Xw35YBpGR6AacHwU:DyvM9yqhMBBgl5Xokiw3MGR6b6

  Score

  10^/10

  redlinefrantinfostealerpersistence

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1