Extracted

• • Target

    391518ddb072635c469fb8eaa6575d2680b8c2542bb95b51159981293941052a

  • Size

    1.7MB

  • MD5

    e1193f055ae2aa309a39592646d1a329

  • SHA1

    a2c1b5c4ea097c543b7318ffc38215820c508958

  • SHA256

    391518ddb072635c469fb8eaa6575d2680b8c2542bb95b51159981293941052a

  • SHA512

    1226d7e75fb1ee2e893ac8460a185052a55adc4f144d448278b93906a0106d8365ff895c1eed64efe280a46873871e6f745c3a72ceee70d62960c174b944bd1f

  • SSDEEP

    49152:MixS2taMyYPiFX7y+tKSYvuusF7zttytZ4f/IHAnGELhappi:z9taMy7FW+tAofttytZ4fHGuaLi

  Score

  10^/10

  redlinekedruinfostealerpersistence

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1