Extracted

• • Target

    d73412beede164a5e5d77c194f502335c8420ab9e9d50ed0e6d91339793680e3

  • Size

    938KB

  • MD5

    159b9bae744c7b1dc5fec9911c26c9eb

  • SHA1

    f24526664a3eadeddd673e5b1a75776291dbcaab

  • SHA256

    d73412beede164a5e5d77c194f502335c8420ab9e9d50ed0e6d91339793680e3

  • SHA512

    22bf1ff3bbf7cbb9e0121fdd4e8e3b17d97b458d9c9f329f8c67a8d7f3be19bce76338a32b1a7d7716b3310be6e7663e94d94a584f812116735ced7a1765df3f

  • SSDEEP

    24576:oyH5eRFzUj1VWydqsLrHMUJllIzTVuoL9GeG:vZKUj1VW5sd219

  Score

  10^/10

  persistenceredlinetuxiuinfostealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2