Extracted

• • Target

    hw7Yo5ND.exe

  • Size

    759KB

  • MD5

    bab1ff48ecae0b1a281bd0ba789d6ee7

  • SHA1

    ca7429dd43749032040b8726e4fa26b97f04604e

  • SHA256

    fb6a3cbde48f761e1594867e1d6d4f18cc25b00335c3d1182317e138d79aafdb

  • SHA512

    af313f7085df2f8bfc3a2773ab9c67d8da4c9dbcbf19260ee9b81f5ec363c528bd70decd9ef8dabe4295f9c5b9c68e63109a65f9d69df10bb14c1a8ca0fe979b

  • SSDEEP

    12288:xMr/y90q7MAHfIK0fESp4gFh1u39pdBMlsANg2hkRutRhNejsYj:yyDDBeXu39VKHHhYL

  Score

  10^/10

  redlinekinzainfostealerpersistence

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2