Extracted

Extracted

• • Target

    e33b1f491539f1f4f57cae4f1a1696f7b3d8ae3dedb0ec1b0f1b0c81b3f0baab

  • Size

    590KB

  • MD5

    c8ce7da93c8306c38f0ab287edd1c056

  • SHA1

    e59d448c703fe9d4aead875c6657d4ae92177928

  • SHA256

    e33b1f491539f1f4f57cae4f1a1696f7b3d8ae3dedb0ec1b0f1b0c81b3f0baab

  • SHA512

    04c2b38ca0239b1ca37921d70060490ad31563edc88e40658cac191544d5335178ea22d243197e8d09b2c5f3e5f84d60a0d72d91caa2bf57e71ebb5bbf198c32

  • SSDEEP

    12288:AMrMy90wlIo7NOFrOgeubcKavElkeH32fr8OdUQVlz12l:8yX57NOFJTbRtJmfZUQDw

  Score

  10^/10

  redlinecrypt1romikdiscoveryinfostealerpersistence

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1