General
-
Target
5c71b8bed631eeeca7e373e0d0b8bfa4
-
Size
509KB
-
Sample
220129-yn9jashcc4
-
MD5
5c71b8bed631eeeca7e373e0d0b8bfa4
-
SHA1
c79d31368ad2f03ecdcc82093f0d165d4445415c
-
SHA256
48c2a26e7e2f02bb50389fae8a5c44d0d7950e1dfe46a2d1d5aadf580db7b8e2
-
SHA512
e7956198551739624d4dd13d61d6f54ad2d16d3503765464d0bbcae0e67cc0b20bcbba6d5e365a5616552b3dcd00358a679cf9bd852409772b2253a1c0174137
Static task
static1
Behavioral task
behavioral1
Sample
5c71b8bed631eeeca7e373e0d0b8bfa4.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
5c71b8bed631eeeca7e373e0d0b8bfa4.exe
Resource
win10-en-20211208
Malware Config
Targets
-
-
Target
5c71b8bed631eeeca7e373e0d0b8bfa4
-
Size
509KB
-
MD5
5c71b8bed631eeeca7e373e0d0b8bfa4
-
SHA1
c79d31368ad2f03ecdcc82093f0d165d4445415c
-
SHA256
48c2a26e7e2f02bb50389fae8a5c44d0d7950e1dfe46a2d1d5aadf580db7b8e2
-
SHA512
e7956198551739624d4dd13d61d6f54ad2d16d3503765464d0bbcae0e67cc0b20bcbba6d5e365a5616552b3dcd00358a679cf9bd852409772b2253a1c0174137
Score10/10-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-