Extracted

Extracted

Extracted

• • Target

    aef22eb354880865965785088ed5bae63967940865414e2785320e4447de0e31

  • Size

    957KB

  • MD5

    cfa5fd8b427e6ff6e826b277e0800010

  • SHA1

    32c2d7cc77415befd35fb1c15e9831507263f52f

  • SHA256

    aef22eb354880865965785088ed5bae63967940865414e2785320e4447de0e31

  • SHA512

    ccb1c70c519694e424ed0d473b28b6d302698fd067c4f56f6516a6ae62e5f9bd35f406427b169e06e411edb20da24fc8a955ef246b42a168b14fd3272db70830

  • SSDEEP

    12288:7bc72o2dAKlpItf+BV3XHSlHYBPHJqXbmxoRj3cQpRnRu9cdTl7Vm:k7p2dAK4tf+BVHHkIoRj3cQDt

  Score

  10^/10

  redlinesmokeloaderkedruplostbackdoorinfostealerpersistencetrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1