Extracted

• • Target

    d9ea87b40a113e503a079e00525f181907a8a0b76970c011b63e8905605752a7

  • Size

    937KB

  • MD5

    0aa2ddcd2d4e77ccddc578f388aec1c5

  • SHA1

    41d8a4f2a438442b379014f489cc30d7fccb4f6b

  • SHA256

    d9ea87b40a113e503a079e00525f181907a8a0b76970c011b63e8905605752a7

  • SHA512

    1b000b78bd3092378017adde81b499c542759f6785574f50ede23502e1e8f5587e6215e14a9183a973eb72146c939e102fa128aa52e58d80cbdb145046d1b354

  • SSDEEP

    24576:uyOgtkTttGEwoqxk0X/wN+NagYb3BCR4h7/HQ:9OkUqLG0XNOb3Dhz

  Score

  10^/10

  persistenceredlinetuxiuinfostealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2