Extracted

• • Target
    -WzUnlockTool.exe
  • Size 1.1MB
  • SHA256 1ee1e1838fddeb669812be73b8c1ebcaa272863ef6816c005ea8a48222f53c31
  • MD5 74be69e45119c12cf49276b25f57954e
  • SHA1 0e198373e3cb8c408ae5abd56ffb42b135236010
  • SHA512 3e42934bb89bbb9a7fd92e52bcc4b1f5990b412f2aa1805536e4542e7853630d343f6576df69faf001c79c18a6eeb28fb17d1ce6fac24fbcf31ccb6418c93d00
  • SSDEEP 24576:dn2w6BFObXB/TYHYkQhz1TmMxHdYtwbdgMX3:IwPbXBSO5gMX3
  • TLSH
    T133454B39E74615F4DA235775858EEB7B9B147A248032AE3FFF8BDA08B4331123C85256
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryredlineinfostealerpersistenceransomware

  • Family: RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Downloads MZ/PE file

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2