Extracted

• • Target

    f1a0f52c11ebd690f97d22449385436ba42b8114304203f45ea5447f8ae1d40c

  • Size

    1.7MB

  • MD5

    be93772fa789dee8c42c901006bd32cc

  • SHA1

    3f30a3ee736b6d4e9fcb64cd8c31b53accc09a89

  • SHA256

    f1a0f52c11ebd690f97d22449385436ba42b8114304203f45ea5447f8ae1d40c

  • SHA512

    6c9000536d62d5eed2499cbc4b4d37d54bb39cf7ff424a144f60cae1ea5e08185edde3cad2b8503e9d5890eafc95fb76f862eb7327b7806e6c4b5f3ccf86e9cd

  • SSDEEP

    49152:UtMvOgcylQmWGbIcFXME11Vj/oMACECE6E:JvOjaQ4H1ME1roV6E

  Score

  10^/10

  redlinekinzainfostealerpersistence

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1