General
-
Target
c49fb42eafdcf7e2b1bd428ecede8924
-
Size
834KB
-
Sample
210721-hrvp5mqd3e
-
MD5
c49fb42eafdcf7e2b1bd428ecede8924
-
SHA1
66f5e4204081659a73d2910b26a5c8be137fff08
-
SHA256
db23b14320b86c540aea73f5475aef99369e0608b76307244d9770e6a807a945
-
SHA512
4f3559c0635209a814f02bb660f46bbf12631bda73c80f10f0a97d2c88483b76bca679248eb0eb52fcc48eb69cdf55fe5498072499e1a9f8efd9ad2f18dae52c
Static task
static1
Behavioral task
behavioral1
Sample
c49fb42eafdcf7e2b1bd428ecede8924.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
c49fb42eafdcf7e2b1bd428ecede8924.exe
Resource
win10v20210408
Malware Config
Extracted
redline
stanntinab.xyz:80
Targets
-
-
Target
c49fb42eafdcf7e2b1bd428ecede8924
-
Size
834KB
-
MD5
c49fb42eafdcf7e2b1bd428ecede8924
-
SHA1
66f5e4204081659a73d2910b26a5c8be137fff08
-
SHA256
db23b14320b86c540aea73f5475aef99369e0608b76307244d9770e6a807a945
-
SHA512
4f3559c0635209a814f02bb660f46bbf12631bda73c80f10f0a97d2c88483b76bca679248eb0eb52fcc48eb69cdf55fe5498072499e1a9f8efd9ad2f18dae52c
Score10/10-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-