General
-
Target
a0c5664aa4a6a4f84d1d8af648c10b8c.exe
-
Size
685KB
-
Sample
210702-53n4p2p2ax
-
MD5
a0c5664aa4a6a4f84d1d8af648c10b8c
-
SHA1
59ae34134303fa91101159f632e681560391b3d4
-
SHA256
fb68afd0254bcaad62a35fe249e9bbcbd10697e900473676576c7fd6c859a293
-
SHA512
44f4e3268dfd1e72dd878e8b5c0a4433925d26ceb573d32eb8e931a1a32a75d5e2a681d5417ddfc01eeedb9e300e17816b3522023f453faf9baedda29856516f
Static task
static1
Behavioral task
behavioral1
Sample
a0c5664aa4a6a4f84d1d8af648c10b8c.exe
Resource
win7v20210410
Malware Config
Extracted
vidar
39.4
890
https://sergeevih43.tumblr.com
-
profile_id
890
Extracted
redline
build1
185.244.182.34:32068
Targets
-
-
Target
a0c5664aa4a6a4f84d1d8af648c10b8c.exe
-
Size
685KB
-
MD5
a0c5664aa4a6a4f84d1d8af648c10b8c
-
SHA1
59ae34134303fa91101159f632e681560391b3d4
-
SHA256
fb68afd0254bcaad62a35fe249e9bbcbd10697e900473676576c7fd6c859a293
-
SHA512
44f4e3268dfd1e72dd878e8b5c0a4433925d26ceb573d32eb8e931a1a32a75d5e2a681d5417ddfc01eeedb9e300e17816b3522023f453faf9baedda29856516f
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
Vidar Stealer
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2
-
Suspicious use of SetThreadContext
-
autoit_exe
AutoIT scripts compiled to PE executables.
-