Extracted

• • Target

    d2fffb4fd8a5fcf0e9d5bc967e1502c7f90fc856fe3bd5132032217d45006922

  • Size

    1.1MB

  • MD5

    836a38caaae69ce3f1f5fc23ced607a4

  • SHA1

    15074e86cb042ffcaf2e2bdf4374a2bce8751733

  • SHA256

    d2fffb4fd8a5fcf0e9d5bc967e1502c7f90fc856fe3bd5132032217d45006922

  • SHA512

    821b8df1cb39900f1ee29738352ecd6905f184d50144b80ea315d9374e0a9cd2c044082925a42a31bb33a61ca284284d362e7f476b0064a0bb3d03a2198d8152

  • SSDEEP

    24576:zyZ0ZGQqWbWXLyCUlv8dhy6u57OeOEfrfZK/DOAwyWCSD2hkuPyaNQ2:GCEallv+ru5TOEfzFihv

  Score

  10^/10

  redlinekukishinfostealerpersistence

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1