Extracted

• • Target

    c81d64eb6a2db5bc0218d4ddbd88b042422ddae397061a767722a5310b4ebb32

  • Size

    928KB

  • MD5

    519596ab5b0b18755fbfc8ad73919d22

  • SHA1

    142e5fdc9756125133a02b72ec0258f54caf8188

  • SHA256

    c81d64eb6a2db5bc0218d4ddbd88b042422ddae397061a767722a5310b4ebb32

  • SHA512

    1c5c19a8834f530a7a5328606c2bc4053ae212b0be957774e36f2c32ba451ea48535ad7efb3425232d86483485973f51b90b1f67f6af66091f9904eb9807698d

  • SSDEEP

    12288:xMrmy90sAF/ev7zEVpmHyZDKZ+kgCZ8XudHeW0txAf8ErCyfKUno2gdR7VV2gho0:nyAF/2zEVpNkgC+uMN08Eha3/haE

  Score

  10^/10

  persistenceredlinetuxiuinfostealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2