General
-
Target
70a5995aa752ada8d7a2c721f6dd8ddc.exe
-
Size
1.7MB
-
Sample
221010-h6n3babbgn
-
MD5
70a5995aa752ada8d7a2c721f6dd8ddc
-
SHA1
3d97999bc3ecaf3e7f2132c0fa597f3ad9ba3137
-
SHA256
dae8a956f37f2e85fdab4204d7c8fcfc262ef9b88806a960202c2bbd720b8932
-
SHA512
a59a469b0df5e95545e8a9171ea29f898a1eba44dc2157eb78fe4bc90e51ffb418c87d44c7c8e6d534131f0e6c761d71740e4d0a8d3b364d8dfed48e3e0185c9
-
SSDEEP
49152:D+/dER5Wh4hsyd32Qu9+1IQcDYl2GjzaU:D+yZ3dl1ICl2IG
Behavioral task
behavioral1
Sample
70a5995aa752ada8d7a2c721f6dd8ddc.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
70a5995aa752ada8d7a2c721f6dd8ddc.exe
Resource
win10v2004-20220901-en
Malware Config
Extracted
redline
Lyla.22.09
185.215.113.216:21921
-
auth_value
2f19888cb6bad7fdc46df91dc06aacc5
Targets
-
-
Target
70a5995aa752ada8d7a2c721f6dd8ddc.exe
-
Size
1.7MB
-
MD5
70a5995aa752ada8d7a2c721f6dd8ddc
-
SHA1
3d97999bc3ecaf3e7f2132c0fa597f3ad9ba3137
-
SHA256
dae8a956f37f2e85fdab4204d7c8fcfc262ef9b88806a960202c2bbd720b8932
-
SHA512
a59a469b0df5e95545e8a9171ea29f898a1eba44dc2157eb78fe4bc90e51ffb418c87d44c7c8e6d534131f0e6c761d71740e4d0a8d3b364d8dfed48e3e0185c9
-
SSDEEP
49152:D+/dER5Wh4hsyd32Qu9+1IQcDYl2GjzaU:D+yZ3dl1ICl2IG
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-