Extracted

• • Target

    1fa7f56e25731d4db03f7597694360bf5042a580da6415f52fb47a1c36914487

  • Size

    1.7MB

  • MD5

    9edd4cb606a9b702afc59c7c39b73576

  • SHA1

    17666310def8602d9af24b0f0c043ff3b1a323c3

  • SHA256

    1fa7f56e25731d4db03f7597694360bf5042a580da6415f52fb47a1c36914487

  • SHA512

    027eee9e1b43b517a906654b709a0ed144c85a41ed6ef412dc779397750ab54fc12c962cd9a387d57b41c9edc6fc62a356dafebfa83812a960ed561b92eba0c6

  • SSDEEP

    24576:4y1dVKwS0EWbk30W5Tpz2No9a1XaT1lVxIRskrT//MbiT38vlcOMr4hM1MMITFsF:/1TBe0ETpz2uk9UItElcOI4eS18F

  Score

  10^/10

  redlinekinzainfostealerpersistence

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1