Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
Overview
overview
10Static
static
10Redline St...ld.exe
windows7-x64
10Redline St...ld.exe
windows10-2004-x64
10Redline St...52.dll
windows7-x64
1Redline St...52.dll
windows10-2004-x64
1Redline St...ib.dll
windows7-x64
1Redline St...ib.dll
windows10-2004-x64
1Redline St...UI.dll
windows7-x64
1Redline St...UI.dll
windows10-2004-x64
1Redline St...db.dll
windows7-x64
1Redline St...db.dll
windows10-2004-x64
1Redline St...db.dll
windows7-x64
1Redline St...db.dll
windows10-2004-x64
1Redline St...ks.dll
windows7-x64
1Redline St...ks.dll
windows10-2004-x64
1Redline St...il.dll
windows7-x64
1Redline St...il.dll
windows10-2004-x64
1Redline St...on.dll
windows7-x64
1Redline St...on.dll
windows10-2004-x64
1Redline St...ls.dll
windows7-x64
1Redline St...ls.dll
windows10-2004-x64
1Redline St...en.dll
windows7-x64
1Redline St...en.dll
windows10-2004-x64
1Redline St...ib.dll
windows7-x64
1Redline St...ib.dll
windows10-2004-x64
1Redline St...er.exe
windows7-x64
1Redline St...er.exe
windows10-2004-x64
1Redline St...et.dll
windows7-x64
1Redline St...et.dll
windows10-2004-x64
1Redline St...ub.exe
windows7-x64
10Redline St...ub.exe
windows10-2004-x64
10Redline St...ll.xml
windows7-x64
1Redline St...ll.xml
windows10-2004-x64
1Behavioral task
behavioral1
Sample
Redline Stealer/Libraries/Build.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Redline Stealer/Libraries/Build.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
Redline Stealer/Libraries/Bunifu_UI_v1.52.dll
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
Redline Stealer/Libraries/Bunifu_UI_v1.52.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
Redline Stealer/Libraries/GuiLib.dll
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
Redline Stealer/Libraries/GuiLib.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
Redline Stealer/Libraries/MetroSet UI.dll
Resource
win7-20220901-en
Behavioral task
behavioral8
Sample
Redline Stealer/Libraries/MetroSet UI.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
Redline Stealer/Libraries/Mono.Cecil.Mdb.dll
Resource
win7-20220901-en
Behavioral task
behavioral10
Sample
Redline Stealer/Libraries/Mono.Cecil.Mdb.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
Redline Stealer/Libraries/Mono.Cecil.Pdb.dll
Resource
win7-20220812-en
Behavioral task
behavioral12
Sample
Redline Stealer/Libraries/Mono.Cecil.Pdb.dll
Resource
win10v2004-20220901-en
Behavioral task
behavioral13
Sample
Redline Stealer/Libraries/Mono.Cecil.Rocks.dll
Resource
win7-20220901-en
Behavioral task
behavioral14
Sample
Redline Stealer/Libraries/Mono.Cecil.Rocks.dll
Resource
win10v2004-20220901-en
Behavioral task
behavioral15
Sample
Redline Stealer/Libraries/Mono.Cecil.dll
Resource
win7-20220901-en
Behavioral task
behavioral16
Sample
Redline Stealer/Libraries/Mono.Cecil.dll
Resource
win10v2004-20220901-en
Behavioral task
behavioral17
Sample
Redline Stealer/Libraries/Newtonsoft.Json.dll
Resource
win7-20220901-en
Behavioral task
behavioral18
Sample
Redline Stealer/Libraries/Newtonsoft.Json.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral19
Sample
Redline Stealer/Libraries/RedLine.SharedModels.dll
Resource
win7-20220812-en
Behavioral task
behavioral20
Sample
Redline Stealer/Libraries/RedLine.SharedModels.dll
Resource
win10v2004-20220901-en
Behavioral task
behavioral21
Sample
Redline Stealer/Libraries/System.Drawing.Pen.dll
Resource
win7-20220812-en
Behavioral task
behavioral22
Sample
Redline Stealer/Libraries/System.Drawing.Pen.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral23
Sample
Redline Stealer/Libraries/Vestris.ResourceLib.dll
Resource
win7-20220812-en
Behavioral task
behavioral24
Sample
Redline Stealer/Libraries/Vestris.ResourceLib.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral25
Sample
Redline Stealer/Libraries/builder.exe
Resource
win7-20220812-en
Behavioral task
behavioral26
Sample
Redline Stealer/Libraries/builder.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral27
Sample
Redline Stealer/Libraries/protobuf-net.dll
Resource
win7-20220812-en
Behavioral task
behavioral28
Sample
Redline Stealer/Libraries/protobuf-net.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral29
Sample
Redline Stealer/Libraries/stub.exe
Resource
win7-20220812-en
Behavioral task
behavioral30
Sample
Redline Stealer/Libraries/stub.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral31
Sample
Redline Stealer/MetroSet UI.dll.xml
Resource
win7-20220812-en
Behavioral task
behavioral32
Sample
Redline Stealer/MetroSet UI.dll.xml
Resource
win10v2004-20220812-en
Target
Redline Stealer Builder.7z
Size
1.6MB
MD5
3317523fcb65de0cad16632d204adf2c
SHA1
8d68b943b791774933acfc6a9b4e6a1e018b2439
SHA256
4f758849cc2c1a02baf4c275ea8fc9cc2fd9a380c157d066a984162fd43cbfe3
SHA512
df0a952becbd4925aa14a1d54dc8ac4b6519043d19960daad27b99f0fc83eeaa07a1dee53b3f0e582d3db0a5012cbbbb6ad67037347f79cb0717c756eb92a796
SSDEEP
49152:UrV0L3E4hsJowplHBzmxQeWNcYFz34a4R:UriL0+6oMBixJ0H1A
resource | yara_rule |
---|---|
static1/unpack001/Redline Stealer/Libraries/Build.exe | family_redline |
static1/unpack001/Redline Stealer/Libraries/RedLine.SharedModels.dll | family_redline |
static1/unpack001/Redline Stealer/Libraries/stub.exe | family_redline |
static1/unpack001/Redline Stealer/RedLine.MainPanel-cracked.exe | family_redline |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
_CorExeMain
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
_CorDllMain
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
_CorDllMain
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
_CorDllMain
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
_CorDllMain
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
_CorDllMain
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
_CorDllMain
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
_CorDllMain
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=US
CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
_CorDllMain
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
_CorDllMain
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
_CorDllMain
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
_CorDllMain
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
_CorExeMain
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
_CorDllMain
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
_CorExeMain
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
_CorExeMain
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ