Extracted

• • Target

    b47a9717e675761f2098dd553004e72065ca1278643ff1bb76c2a52bdef50bfc

  • Size

    1.5MB

  • MD5

    9ff5bbb2adefb4d1b48d1a83882eb237

  • SHA1

    2003fc0f2a49d844ddfe18841429cc94a8469e84

  • SHA256

    b47a9717e675761f2098dd553004e72065ca1278643ff1bb76c2a52bdef50bfc

  • SHA512

    4444cf16199455207c5e12eb88e1f2161da16737cd3bca56169ec31b52261e681bd8910b97e732f6fd11c44e6b5e81af03ae5f0a2205dc4225d256b5a2affe43

  • SSDEEP

    24576:by4IllaZnXqbQTCKRSEt43nT85W30dbNV7AehpSCkxk/gDza1het4l:OJ/2XqbQTrdyb0dpV7AdYg61MC

  Score

  10^/10

  redlinekinzainfostealerpersistence

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2