Extracted

• • Target

    61799398eaa0d8b997b6fa9158074d701b10e120c7cac093e92c6dfbd278f50c

  • Size

    1.2MB

  • MD5

    b98446b0f18286a42da76de220776baa

  • SHA1

    a71b450e1661dcde86def137230b3caa1b55e6a3

  • SHA256

    61799398eaa0d8b997b6fa9158074d701b10e120c7cac093e92c6dfbd278f50c

  • SHA512

    a3880d6f69705178d6847e326d54f30a2bd9f739946426af2125502ee32a494691cf0df1a1e55e34c17a9bd3db4291e98e67f7db8accdf50166e201299532e08

  • SSDEEP

    24576:iyEr/lyO4yJtpTven2JuR98YZ1uIEUs74Vlpu4yNkXPGLJpqYm:JELfVJtpnJuh1uJ374VXu4sEPGLJpqY

  Score

  10^/10

  redlinelutyrinfostealerpersistence

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1