Extracted

• • Target

    4a9e8ca9ea84eda816e17563d82aecce.exe

  • Size

    1.7MB

  • MD5

    4a9e8ca9ea84eda816e17563d82aecce

  • SHA1

    93d6da4b044c63b6472df580432ee150983a1b1e

  • SHA256

    2a23adc1358d4c8fe27501ffa5321aff351f3d6483761124919193a42e7e6141

  • SHA512

    80bff1e0a389000a7f50bf1716ff86a95a8b0c1e9e76c5d2fab050abd50747190f55908faa5a97232c89044baa8e3de2d2c092829e3cab295c1d471ad90ffc54

  • SSDEEP

    49152:3Iy5CPKTrB3YdjFIF0baiOh+Ct4HiAMFmJ:9rtQyKRO0g

  Score

  10^/10

  redlinekinzainfostealerpersistence

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2