General
-
Target
GI_HackV2.1.exe
-
Size
203KB
-
Sample
211024-sdwa2afchp
-
MD5
0c6581c92d964a774e3d890a8a2bca08
-
SHA1
393bf6a2f0c6f6826ebba98ce6a4483b80ba16ea
-
SHA256
1073f4d58084a1341acbc0fd3a3b17ee2794f16bf62b3b317b2117f28c12cc6b
-
SHA512
c456b1c31d73126763c09a35f04145cf6e28f5b249b617f67bd7397518ade48a006ea52242a70c7496000b102c18009c34634826ddfb40a1d4de7c6d2b3f0c0c
Static task
static1
Behavioral task
behavioral1
Sample
GI_HackV2.1.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
GI_HackV2.1.exe
Resource
win10-en-20211014
Malware Config
Extracted
redline
37.252.9.247:37711
Targets
-
-
Target
GI_HackV2.1.exe
-
Size
203KB
-
MD5
0c6581c92d964a774e3d890a8a2bca08
-
SHA1
393bf6a2f0c6f6826ebba98ce6a4483b80ba16ea
-
SHA256
1073f4d58084a1341acbc0fd3a3b17ee2794f16bf62b3b317b2117f28c12cc6b
-
SHA512
c456b1c31d73126763c09a35f04145cf6e28f5b249b617f67bd7397518ade48a006ea52242a70c7496000b102c18009c34634826ddfb40a1d4de7c6d2b3f0c0c
Score10/10-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-