Extracted

• • Target

    896076e2395a4fc3436e11dfe43a1dbf5da4b2d4aeb118efce39419ce6180a67

  • Size

    1.7MB

  • MD5

    f340ab29800ff080a08399cd10bf2efb

  • SHA1

    20fee2c50f52494faaad947b9c6b754ed55d5ef6

  • SHA256

    896076e2395a4fc3436e11dfe43a1dbf5da4b2d4aeb118efce39419ce6180a67

  • SHA512

    ed3ae0b8effc008c38f538efe7721649c647951c3ac0096ac9c41692c6859dfe96610302e7ff8de446309400baf25ca6c379bccd9d6ecf4ebd21c30aed76f534

  • SSDEEP

    49152:DXw5j5xC/d7bjHcTyBivNscva7ifJZs/eA7:Dwt5sv7c4OzC7EvaH

  Score

  10^/10

  redlinekinzainfostealerpersistence

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1