Extracted

• • Target

    0ab71d7aea06c7a310786324cdec3dcfb17630596ce517abfdf56804e736de83

  • Size

    1.5MB

  • MD5

    3b421a45acd57067991e35ec30df3c35

  • SHA1

    ee4afdccc1edc683b988712a8016837d13d1ad77

  • SHA256

    0ab71d7aea06c7a310786324cdec3dcfb17630596ce517abfdf56804e736de83

  • SHA512

    ef590b5870b4fb07d4aa14d4f5f0111f820c0e58d28595be6b4d536292c563bcfcca49d4815212e53283030b62e7c9d7231948c36782d32e66ed2446d0bfd5e8

  • SSDEEP

    24576:6yBhbaOA5ad3nBv/0mwLAwNV+9/mCFzNc6Tove34OQ+DuWu5ua1caq:BBpzd3x8CwW9/mIznToqg+La

  Score

  10^/10

  redlinekinzainfostealerpersistence

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1