General
-
Target
fd0fadecf054fd384b0964b72331387a79d621a90383706838713f086d12ee74
-
Size
279KB
-
Sample
220629-bcr4jsfdd9
-
MD5
e8a3b9038499e57efa0fac179995c4eb
-
SHA1
4584bea5ef3c4d6dd4de7bc1162ab5a3000cf6d1
-
SHA256
fd0fadecf054fd384b0964b72331387a79d621a90383706838713f086d12ee74
-
SHA512
063874174ab32f003a26bdf2ee7651e7ff08eeac21bcc8f122a25b840f8901fbcf6ed8289f321e817bc507a86cc54b9c8e715ccc00de12735022723175d28b13
Static task
static1
Behavioral task
behavioral1
Sample
fd0fadecf054fd384b0964b72331387a79d621a90383706838713f086d12ee74.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
fd0fadecf054fd384b0964b72331387a79d621a90383706838713f086d12ee74.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
redline
mario2
193.106.191.129:80
-
auth_value
4ef7e3fec3a418b2f0233b604d0560d9
Targets
-
-
Target
fd0fadecf054fd384b0964b72331387a79d621a90383706838713f086d12ee74
-
Size
279KB
-
MD5
e8a3b9038499e57efa0fac179995c4eb
-
SHA1
4584bea5ef3c4d6dd4de7bc1162ab5a3000cf6d1
-
SHA256
fd0fadecf054fd384b0964b72331387a79d621a90383706838713f086d12ee74
-
SHA512
063874174ab32f003a26bdf2ee7651e7ff08eeac21bcc8f122a25b840f8901fbcf6ed8289f321e817bc507a86cc54b9c8e715ccc00de12735022723175d28b13
Score10/10-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Suspicious use of SetThreadContext
-