General
-
Target
2222.exe
-
Size
971KB
-
Sample
200715-km4qnjael2
-
MD5
afb5ca30463a0f986b50e18b5ea084fb
-
SHA1
c86675886cd568cc9504ba3c5a91f8dd8e046ff7
-
SHA256
a75040c1f0f11bf9629774525960c9cf35153727e1191057b575fb3c1ed0700a
-
SHA512
c897013100699c160b9f1add512a8e556d919f6036a77b74629ec2e077450532c607205b5a9066daa4ae14ddb14d529037e822bafc0dd8dc5213a97af959efca
Static task
static1
Behavioral task
behavioral1
Sample
2222.exe
Resource
win7v200430
Behavioral task
behavioral2
Sample
2222.exe
Resource
win10
Malware Config
Targets
-
-
Target
2222.exe
-
Size
971KB
-
MD5
afb5ca30463a0f986b50e18b5ea084fb
-
SHA1
c86675886cd568cc9504ba3c5a91f8dd8e046ff7
-
SHA256
a75040c1f0f11bf9629774525960c9cf35153727e1191057b575fb3c1ed0700a
-
SHA512
c897013100699c160b9f1add512a8e556d919f6036a77b74629ec2e077450532c607205b5a9066daa4ae14ddb14d529037e822bafc0dd8dc5213a97af959efca
Score10/10-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-