Extracted

• • Target

    b5316985a1a10908baf2bb08ffb4b6a35e9169a1d8d274f349c9363a39628210

  • Size

    1.3MB

  • MD5

    73433d21fa9f1146b510c5d6cf635181

  • SHA1

    0e4732528e7127948b9905261350c8c3c7eb2708

  • SHA256

    b5316985a1a10908baf2bb08ffb4b6a35e9169a1d8d274f349c9363a39628210

  • SHA512

    c9341b26f07f7ae09ee590e47429efa4d0c43f6b2f35466222d909f263e8c3caf58df335953d0f35370dc8bfc625560ecc467ef36502fe334988fb403ccb9971

  • SSDEEP

    24576:/yG4bqoBkT4+iP+Pbou1A9tZxCFAmiYCrpwdSHuaLdl9:KG4bqopP+DDAz/miY20mfL7

  Score

  10^/10

  redlinehordainfostealerpersistence

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1