Extracted

• • Target

    30d145e7fcc8458f7998e746afadea4aa1c3e9ed1ee4623accc8c6be4d893754

  • Size

    1.7MB

  • MD5

    8e1c92f8a582cab7ff5161338a9beaba

  • SHA1

    6f747b06f527ee2f4fe67d3570dbd2380f7f5c2b

  • SHA256

    30d145e7fcc8458f7998e746afadea4aa1c3e9ed1ee4623accc8c6be4d893754

  • SHA512

    59db986a4a9daf75123b338d4af622027ca641d6e0754a9ab02326a91aa8fc752338c1ba9dd80115061fa430973d044e6874c496025ca1751dfbc84f98455432

  • SSDEEP

    49152:V5ZBYxRVhs2qq02cioJ2Bv+Sf79OfIB4T237:LZBwxpbMJMv+Sf01s

  Score

  10^/10

  redlinekinzainfostealerpersistence

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1