Extracted

• • Target

    42a1cff98f89f0ee7182d7ac32ae52a81a451903964770b393b8376dc5a43293

  • Size

    955KB

  • MD5

    7bfccd0f9043dda8152eaabc649f85d8

  • SHA1

    59bc6d933d6a6aa68963f0d0ea48159bd9a9aae4

  • SHA256

    42a1cff98f89f0ee7182d7ac32ae52a81a451903964770b393b8376dc5a43293

  • SHA512

    5b60d473a80d272acd3f800484bf54b3803ca9df2ff117e2110fcc8deedd84e28347e9e4091e229e0dcf973217583a9e24476f34c49f602ffa2cfd49babd04d9

  • SSDEEP

    24576:nyOfd3JDrLab468Ctg1DVyX8cWS3TQaVzU3vX1:yOfnLab46O1DVS8cRTQae

  Score

  10^/10

  persistenceredlinetuxiuinfostealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2