Extracted

Extracted

Extracted

• • Target

    4a7d7e170aefb6211578cf310859024b32916b1aa58774fadef012877db3afdf

  • Size

    942KB

  • MD5

    065f83d071191397941e89505838a977

  • SHA1

    339db25a56814a4abc658603ec222a1cd192cd34

  • SHA256

    4a7d7e170aefb6211578cf310859024b32916b1aa58774fadef012877db3afdf

  • SHA512

    3f6f54621805285a7d230d97c19a9c4101dd63bd2f68fe1c6cea63b035b30e145d8db193fbde58007d56867ba71fb8be21df9b4d4a11562a21ee50439d6c78a2

  • SSDEEP

    12288:D72y6T2E/mNwqKbov27C9OV266iq00ARW8jvBvGg5FEzzWuM1EKFj6:/2y6tmNw3bov27HVW3IRW8jP5FE30J

  Score

  10^/10

  redlinesmokeloaderkedruplostbackdoorinfostealerpersistencetrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1