Extracted

• • Target

    bae1435c2568e7d2fd897523f15f55d7a15d62793a26e726acb8ac8df55ba960

  • Size

    1.2MB

  • MD5

    d725f316f6e11449170743aca1680036

  • SHA1

    e8b15fef1faf90d8a314e499211643d21dae7dc5

  • SHA256

    bae1435c2568e7d2fd897523f15f55d7a15d62793a26e726acb8ac8df55ba960

  • SHA512

    288fbe947afb48c9c9530150de07779b0386649b09af618b77325bdc401c7c65558d81dba8cc32bac8097a994d2b62a64453da0480bc78b39ee6abacc5032231

  • SSDEEP

    24576:WyW4tae1sL27ESWmTajggwwD36TEgfKSsE9kOzHVKtc2W:l7oeea7kNnwwb6Ttc6k0

  Score

  10^/10

  redlinekolyaninfostealerpersistence

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1