Extracted

• • Target

    490a06c09c0e1c35c58f333721fa59eb039910a752c9c11bcec543d5ed9860f1

  • Size

    1.5MB

  • MD5

    f15584fe8b4fb3624fed6bedab1f8214

  • SHA1

    1945fc68d33ab24844fecac36a1c896470067a9a

  • SHA256

    490a06c09c0e1c35c58f333721fa59eb039910a752c9c11bcec543d5ed9860f1

  • SHA512

    d44829488777ce829f31fc4521028054ced709cd25206f95077318013456db5aaef73328faecc24cf868fb26994ced3258dde0cfcf2ac493c9fa3a7467fba3a2

  • SSDEEP

    24576:dyKOBroH2OqUBgamcvdJ6S+3ljiWoUjjDjtJx3Eyc9Yu3rK:4KOBrJOp7mKdE7leWnRUf9Yu

  Score

  10^/10

  redlinekinzainfostealerpersistence

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1