General
-
Target
Installer.exe
-
Size
168KB
-
Sample
211024-thx6vsfebk
-
MD5
2853908eb84e04fb6f89067d3f11c13b
-
SHA1
52599b74438e3af584ca6ceddbf4edb149567bb1
-
SHA256
4df51739c06f4aedf119be89182dd6a8adaa6784ffe9305de0756fb8aaec2164
-
SHA512
e9798a26a5cbbeb965c697ca9153a8c9f1424e61ee6c47c260b97416697cc84ac0ada2bf89188f5deba9c9537a8f502cc0bbbc302d5df639e4d3a4b30d871ecc
Static task
static1
Behavioral task
behavioral1
Sample
Installer.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
Installer.exe
Resource
win10-en-20210920
Malware Config
Extracted
redline
141.94.188.139:43059
Targets
-
-
Target
Installer.exe
-
Size
168KB
-
MD5
2853908eb84e04fb6f89067d3f11c13b
-
SHA1
52599b74438e3af584ca6ceddbf4edb149567bb1
-
SHA256
4df51739c06f4aedf119be89182dd6a8adaa6784ffe9305de0756fb8aaec2164
-
SHA512
e9798a26a5cbbeb965c697ca9153a8c9f1424e61ee6c47c260b97416697cc84ac0ada2bf89188f5deba9c9537a8f502cc0bbbc302d5df639e4d3a4b30d871ecc
Score10/10-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-