Extracted

• • Target

    532b241bb55c86388db422bab4327f29381c267e485905769b105ba6b1bf05b0

  • Size

    1.5MB

  • MD5

    9dcaf48802c4c3ad52af5f557c8c1fc6

  • SHA1

    91c19ee7cb86f90c096af379af0fee2f50d8eb39

  • SHA256

    532b241bb55c86388db422bab4327f29381c267e485905769b105ba6b1bf05b0

  • SHA512

    c7ffd90615bd9a4eb0a6e50be127c2f2a84b404cb4f9c262b509f98d598e57314cbd4809dfaa61b117e19aec2273302195fcc6ddff05909986563dd9b31f9323

  • SSDEEP

    24576:vyov2UtfpkzCOVBJ7BPF8YcfVqdv94SWj31msg7y/ngjq30j7bQk0b3CgFxZCH8z:6ov2XCO95FXd94PjRIiMfQk0jCgkH8S

  Score

  10^/10

  redlinekinderinfostealerpersistence

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1