General
- Target Unlock_Full_Version.exe
- Size 2.5MB
- Sample220727-ggvywsecd9
- SHA256 2db6cd80ce5ea27df6fab04ad7367f8c79484b0b1fcad55f339a0a74d0efac03
- MD5 a8261a5d8829b6ea26e087e62ef5ce92
- SHA1 e137a882d46676032d69b6961b76ac8a0533fc1e
- SHA512 a7b054e735afc2308069f068e2dd0b3d3e82798bf3e6e989b470027dd9368eb90627e25968111cad9a720638e924c1454362828626236270497e321ba7604235
- MD5 SHA1 SHA512
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
Unlock_Full_Version.exe
Resource
win7-20220718-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
Unlock_Full_Version.exe
Resource
win10v2004-20220721-en
7 signatures
150 seconds
Malware Config
Extracted
Family
-
redline
Botnet
-
@g0r0dgreh0v
C2
-
167.235.227.36:14055
Attributes
-
auth_value
a3f30b8236ae3673e7036382c344ed47
Targets
-
- Target Unlock_Full_Version.exe
- Size 2.5MB
- SHA256 2db6cd80ce5ea27df6fab04ad7367f8c79484b0b1fcad55f339a0a74d0efac03
- MD5 a8261a5d8829b6ea26e087e62ef5ce92
- SHA1 e137a882d46676032d69b6961b76ac8a0533fc1e
- SHA512 a7b054e735afc2308069f068e2dd0b3d3e82798bf3e6e989b470027dd9368eb90627e25968111cad9a720638e924c1454362828626236270497e321ba7604235
- MD5 SHA1 SHA512
Score10/10-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Suspicious use of SetThreadContext