Extracted

• • Target

    2fef5824862e6a49e4ccc50a4a2a852a593376f7ea95f715530f943ba49fe6f1

  • Size

    267KB

  • MD5

    ef9ca70006456b5454a91555a50f9838

  • SHA1

    75721a16ad42f6494479ff6be2527b76af41c5d6

  • SHA256

    2fef5824862e6a49e4ccc50a4a2a852a593376f7ea95f715530f943ba49fe6f1

  • SHA512

    c432b80d2e5392c6b6117178544943b907ea7e0ebf74c87a0bd28f51cf3c84feaf4c22fea2d9533288fe7585a85d5cd921707df5208049d667145866e0ca4253

  • SSDEEP

    6144:4YcllhS4qdxjPxUUsOhETPDJtNJEQcwbOFRcmmKU:na/SNRqJtf/cOsEKU

  Score

  10^/10

  redline5345987420discoveryinfostealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2