Extracted

• • Target

    214bf81662defaad32e8eb09de0922221f985b7d1633c35c373c62c58b4c9106

  • Size

    505KB

  • MD5

    de34baf3d86666daa4c01950d5275661

  • SHA1

    31221a20c80fa67a6eafa49d0fed56d292d1e463

  • SHA256

    214bf81662defaad32e8eb09de0922221f985b7d1633c35c373c62c58b4c9106

  • SHA512

    17c93ab88424f58819eb97e6c82d6a8b3c59ebc8259e5d3ffe729b924eab74bd97bd5498f47948b875c923fb96817014812b2e6828251eccf1d2c6244b6e8bd3

  • SSDEEP

    6144:Kqy+bnr+Cp0yN90QEY/0dkWujZN0KyJqrDbwNNDO//R0X745DLjxyPyLk3TFdiNB:yMrWy90SyJQbsRAR0Xynxy3dwcM

  Score

  10^/10

  persistenceredlinetrushinfostealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2