General
-
Target
Top.exe
-
Size
212KB
-
Sample
211024-vxlxtaeff9
-
MD5
96427c202bca1af1acd22256c92cc898
-
SHA1
728fd65a135a31b83138cc7b1e0754b17bb5ee81
-
SHA256
73186a5d3be2fa9711f31dfbac376773f5e05116652ff2d413edea2390670ee5
-
SHA512
9ddd65f6d72b00838189b7e954a91fd182e5d7808aa2927f762945d3991982649ef3d6bc745e22552fdfea02e5afae452e9f03ec86ee63f6fc49875c95d60d56
Static task
static1
Behavioral task
behavioral1
Sample
Top.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
Top.exe
Resource
win10-en-20211014
Malware Config
Extracted
redline
@Top_seller_ak
51.91.193.177:18717
Targets
-
-
Target
Top.exe
-
Size
212KB
-
MD5
96427c202bca1af1acd22256c92cc898
-
SHA1
728fd65a135a31b83138cc7b1e0754b17bb5ee81
-
SHA256
73186a5d3be2fa9711f31dfbac376773f5e05116652ff2d413edea2390670ee5
-
SHA512
9ddd65f6d72b00838189b7e954a91fd182e5d7808aa2927f762945d3991982649ef3d6bc745e22552fdfea02e5afae452e9f03ec86ee63f6fc49875c95d60d56
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Drops startup file
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-