Extracted

• • Target

    7ea22fbd62c7190c5ab3a5ac8f0f22899b0d7972bc9f642fbfbd2bf8e8aa5539

  • Size

    267KB

  • MD5

    aeaa53c59a3e130c91c0e738f581ff11

  • SHA1

    209fabb8d4cbc8d4eb840101b0868d949b33d627

  • SHA256

    7ea22fbd62c7190c5ab3a5ac8f0f22899b0d7972bc9f642fbfbd2bf8e8aa5539

  • SHA512

    96c28954ba3e7d5ef06b4afef526e3ac628b86adfa29fb9e08bbd5482b8af0ef748afa1d1bdb36218a9e586803dd31d2c01a916d419c8294d446e49157746cc3

  • SSDEEP

    6144:LvcllhS4qdxjPxUUsDncM1E7aQASk5WtdYOBWwDmmKU:ba/SNR9UlSkkvew3KU

  Score

  10^/10

  redline7001210066discoveryinfostealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2