Extracted

• • Target

    f2fc2216d576f6e5bf41c5175a93129d6049a5aa8667cd7087fbab789b2f8fa2

  • Size

    1.3MB

  • MD5

    8f64a111a3356ad4b9db47f64a07d10b

  • SHA1

    738bc4d4b556daeef053ba0015daef00900d4ac6

  • SHA256

    f2fc2216d576f6e5bf41c5175a93129d6049a5aa8667cd7087fbab789b2f8fa2

  • SHA512

    e1e703a2d3020d3a2dfe3390d000a9146dbba45719a2f5b953b78f896741ede144fbe2e8dabd86705f132dda8a7e3572d7ff48b67e0e9f7677c19fe7abb94641

  • SSDEEP

    24576:SyAOODcXDhWFAWlKikLRyJBaFxQYyCJam2q6lQ+wGnpu/uY:5AOODcXQFAWZMRkSsCJSqr+Jpu/

  Score

  10^/10

  redlinehordainfostealerpersistence

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1