Extracted

• • Target

    1fbdb25205f7869f90738640f3afbacfe796532d8738bb0522aeae3963aaf0f7

  • Size

    1.5MB

  • MD5

    44e515bbbd2c68ca226c0c78b074bb3e

  • SHA1

    af39abea28203ee43f0e559bb58edfe137afb75e

  • SHA256

    1fbdb25205f7869f90738640f3afbacfe796532d8738bb0522aeae3963aaf0f7

  • SHA512

    cee6bf9cd4b962aae960e8e27ef13c269d5566234d1f5b972512f4b5c4bfe304bff8396fd20db2ee512befebd59d0bbafe8a1e9260638d28f467f262bb4048e8

  • SSDEEP

    24576:MyEZqtScxGfrXDnqLGFDOsTKtC71uKftOSgve7WIj1u+iveR4:7ltVIzDnqL8OTtMwm3WAT

  Score

  10^/10

  redlinekinderinfostealerpersistence

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1