General
-
Target
iu35ryECDcB7YnmA9O.exe
-
Size
854KB
-
Sample
211105-gsw1bsfggr
-
MD5
6160d9cc6de5bd6d63abf3a90492f72b
-
SHA1
b37c3ef6fc4c4af664ba0b8dbaaeb065988980d5
-
SHA256
6542a64376516f4aa87b9dd2cb2978b6e83441964110aa291d7a04bceb511d97
-
SHA512
f5ef576b2b5de73b6287be8b49454072744afae2e233e3efaf6666f8509472339eb8d9123220b8b1fbe4100b76f51777294551afa3dab8c095b71e2f51414c08
Static task
static1
Behavioral task
behavioral1
Sample
iu35ryECDcB7YnmA9O.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
iu35ryECDcB7YnmA9O.exe
Resource
win10-en-20211104
Malware Config
Extracted
redline
031121
m360li.info:81
Targets
-
-
Target
iu35ryECDcB7YnmA9O.exe
-
Size
854KB
-
MD5
6160d9cc6de5bd6d63abf3a90492f72b
-
SHA1
b37c3ef6fc4c4af664ba0b8dbaaeb065988980d5
-
SHA256
6542a64376516f4aa87b9dd2cb2978b6e83441964110aa291d7a04bceb511d97
-
SHA512
f5ef576b2b5de73b6287be8b49454072744afae2e233e3efaf6666f8509472339eb8d9123220b8b1fbe4100b76f51777294551afa3dab8c095b71e2f51414c08
-
NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Drops startup file
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2
-