Extracted

Extracted

• • Target

    1051b63ee8d8ece1acbaf428ee72063404bdd44563ec96d0e150e5bbdaa32a69

  • Size

    839KB

  • MD5

    d5618df7549a93341823b3d0c276ff46

  • SHA1

    d942ab0867e770f29c69ef95366e86c95f861cd0

  • SHA256

    1051b63ee8d8ece1acbaf428ee72063404bdd44563ec96d0e150e5bbdaa32a69

  • SHA512

    073bb3407669e8bbdedd02bcfc6059bf3c76770ff0cd3866342ec1a62a29976240fc4467d4b31c1ff2a4a2f33161aa9a3088a533ebe12e2bba9eb0771de5f850

  • SSDEEP

    12288:KMrdy90RJy1j+1OS1ekd+Cyom938NOfrO2CuHHKaGEQNe239ZrTUdUKWZz15k5sC:7yYyj+8Vlb93IOfFnHqJc6ZmUKwQKC

  Score

  10^/10

  redlinecrypt1romikdiscoveryinfostealerpersistence

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1