General
-
Target
file.exe
-
Size
603KB
-
Sample
221014-wh1cbseaaj
-
MD5
dd1ad945db47825113b0e951efc4329e
-
SHA1
c4a2434faf1e56b006e66bbfdf00b6b338d5412c
-
SHA256
c6d746c1cfde6d2f1d19a371be49f86cb8baf750f3678fdeea5803dea510a0d2
-
SHA512
2369cf1deaa2d656eb84811f08103ba632e4b11b8347139b4a821d96a36379576905cfa188825a774a7cfffe33f4348d396dbde0b4b0c3ab31b33503bc1f6b9d
-
SSDEEP
1536:srae78zjORCDGwfdCSog01313hEs5gQOcIKMJ+8P:0ahKyd2n31xd55OcIKMJ+8P
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
redline
Nigh
80.66.87.20:80
-
auth_value
dab8506635d1dc134af4ebaedf4404eb
Targets
-
-
Target
file.exe
-
Size
603KB
-
MD5
dd1ad945db47825113b0e951efc4329e
-
SHA1
c4a2434faf1e56b006e66bbfdf00b6b338d5412c
-
SHA256
c6d746c1cfde6d2f1d19a371be49f86cb8baf750f3678fdeea5803dea510a0d2
-
SHA512
2369cf1deaa2d656eb84811f08103ba632e4b11b8347139b4a821d96a36379576905cfa188825a774a7cfffe33f4348d396dbde0b4b0c3ab31b33503bc1f6b9d
-
SSDEEP
1536:srae78zjORCDGwfdCSog01313hEs5gQOcIKMJ+8P:0ahKyd2n31xd55OcIKMJ+8P
-
Detects Smokeloader packer
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-