Extracted

• • Target

    db1cf22ad5c121fddac7a006b4e9eb189a245cebea1e166a4a0e5e70035bdb61

  • Size

    1.7MB

  • MD5

    524c2296f91592fdbf9613097fd3ffef

  • SHA1

    8956a58914d10440da304a48104367b55d8cef52

  • SHA256

    db1cf22ad5c121fddac7a006b4e9eb189a245cebea1e166a4a0e5e70035bdb61

  • SHA512

    f08355c2d05a877aba3356c2ee94542b25d43171da31985cd73192dd62827f7853c561142fbcef7bc6f24fd496b8bb2d68240a335e3c4e8a57dff721fedb0949

  • SSDEEP

    24576:vyly6xAzo/WWbndHstt1C2ztutHUsAMd7LezZs8zUmeTousswiGyg5/OMJxyIWia:6lnyoJnNstQtH7Xd7szzUFLss4OMLy7

  Score

  10^/10

  redlinekedruinfostealerpersistence

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1