Extracted

• • Target

    56e3cedd66a710e7249c4601f89bcf4a14539fb5ff74b823e2f671f975716099

  • Size

    1.2MB

  • MD5

    ee19f3134a2d6e8776bd327f2cfe9242

  • SHA1

    c7e6ebd040192d411f883bf7b5695d95785c38e0

  • SHA256

    56e3cedd66a710e7249c4601f89bcf4a14539fb5ff74b823e2f671f975716099

  • SHA512

    9e516a27f64e5ff2853103139a9b2f7b70a15f8f9e5cd73bd134496d9e248a4b85d4812686c58933e79b39f17cee2ae01cf8c97fef7204b4c066edc00ac82989

  • SSDEEP

    24576:vyDHxmo7v4YCq1M+8xo2zX2yuPX5xkn79p+5ZPMAIE3aYDP:6Dn7pz12T2PRxO7LqaY

  Score

  10^/10

  redlinelutyrinfostealerpersistence

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1