General
-
Target
tradecheat.exe
-
Size
1.8MB
-
Sample
211024-tvsrxafedm
-
MD5
c7d14620434af78c9c97915ce1ad2f3e
-
SHA1
f68964448d84fea2cb727e1048f22531e6bacb06
-
SHA256
6c798312f1aa6826f5e1dcc49ae54d4011d0e28245b3e6be0803dfd4381c6acb
-
SHA512
7153ad04f977df8464007f26348d28b08a7de854e6640d39cc74212a730b5f4522eb0b209edbc420f83817d05f6748a19882dd113f559fee6ad1d964d58ba132
Static task
static1
Behavioral task
behavioral1
Sample
tradecheat.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
tradecheat.exe
Resource
win10-en-20210920
Malware Config
Targets
-
-
Target
tradecheat.exe
-
Size
1.8MB
-
MD5
c7d14620434af78c9c97915ce1ad2f3e
-
SHA1
f68964448d84fea2cb727e1048f22531e6bacb06
-
SHA256
6c798312f1aa6826f5e1dcc49ae54d4011d0e28245b3e6be0803dfd4381c6acb
-
SHA512
7153ad04f977df8464007f26348d28b08a7de854e6640d39cc74212a730b5f4522eb0b209edbc420f83817d05f6748a19882dd113f559fee6ad1d964d58ba132
Score10/10-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-