General
-
Target
file.exe
-
Size
2.4MB
-
Sample
220830-rma6saaafk
-
MD5
15b60741614632d10fc561535b75935b
-
SHA1
cbea369646f9ad26517b95941a73275fffe1220b
-
SHA256
abf1505ddbd0bdc60a8bae7500f3d18681012a2f3e4df647eb2541013cc888dd
-
SHA512
78a76a5a4dcd80be631dc404236bac9f8de748a2a6dd89d497a36a06447a7313c7d8d478ea1a04abb44b249dbf7409811d94f047f8982ceb1495e6450aff3090
-
SSDEEP
24576:WetIOFYAYdzi96rM/Wo6erbgt16SDslT49pAm7lau4Cz4gEKL9IQl3RuQ55313N:WQIji+Dsls9qA0u424gEKDl37
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
redline
@forceddd_lzt
5.182.36.101:31305
-
auth_value
91ffc3d776bc56b5c410d1adf5648512
Targets
-
-
Target
file.exe
-
Size
2.4MB
-
MD5
15b60741614632d10fc561535b75935b
-
SHA1
cbea369646f9ad26517b95941a73275fffe1220b
-
SHA256
abf1505ddbd0bdc60a8bae7500f3d18681012a2f3e4df647eb2541013cc888dd
-
SHA512
78a76a5a4dcd80be631dc404236bac9f8de748a2a6dd89d497a36a06447a7313c7d8d478ea1a04abb44b249dbf7409811d94f047f8982ceb1495e6450aff3090
-
SSDEEP
24576:WetIOFYAYdzi96rM/Wo6erbgt16SDslT49pAm7lau4Cz4gEKL9IQl3RuQ55313N:WQIji+Dsls9qA0u424gEKDl37
Score10/10-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Suspicious use of SetThreadContext
-