Extracted

• • Target

    9ed1352e066e59833c47b37735d002d6.exe

  • Size

    1.5MB

  • MD5

    9ed1352e066e59833c47b37735d002d6

  • SHA1

    8c7519a69a08394040074542a69ffa9998744502

  • SHA256

    0da921990e3adf5f4e1e222e4de086733839772aabd9caa954600baa797968c4

  • SHA512

    2f74102b6a0187fe275894cb783918edbd23535b30a84e93b7571340bd9d0ee5c12b9ed07298e0e14745de2f145c5e2d88a5057dcd4ca20dbb6b3a70e3875e2b

  • SSDEEP

    24576:oybbfe9uSpo+3YAggyr6AhgwyGMDckTdIxLkwiRjwEEcd/9c9Ln3aePBpV9yG:v3rSbgr60eVIxvi2tcd1CL1Bpy

  Score

  10^/10

  redlinekinzainfostealerpersistence

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2