Extracted

Extracted

Extracted

• • Target

    4e94c178454111d2759902fb99880c7b27b92b6c2134ba5a7b286dc84fa88d0c

  • Size

    957KB

  • MD5

    7aaec66dc0947406dca40214cfd234dd

  • SHA1

    236fda20926839a33fd822f502b3c8e0f0a3981f

  • SHA256

    4e94c178454111d2759902fb99880c7b27b92b6c2134ba5a7b286dc84fa88d0c

  • SHA512

    6869df3a9205052213d073f9bf0a2155c813e0e6747ee780196fe408b47fcac81fa575b1fdd69497d24c512c16fed9e3f00c61532ad8c4a0cde99a7d530acec6

  • SSDEEP

    12288:Gbcilo2dAKlpItf+BV3XHSlHYBPHJqXbmxoRj3cQpRnRu9cdTWQ:jii2dAK4tf+BVHHkIoRj3cQD

  Score

  10^/10

  redlinesmokeloaderkedruplostbackdoorinfostealerpersistencetrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1