Overview
overview
10Static
static
3packages/A...ut.pdf
windows7-x64
1packages/A...ut.pdf
windows10-2004-x64
1packages/A...ts.xml
windows7-x64
1packages/A...ts.xml
windows10-2004-x64
1resources/...IM.dll
windows7-x64
4resources/...IM.dll
windows10-2004-x64
4resources/...sel.js
windows7-x64
1resources/...sel.js
windows10-2004-x64
1resources/...x.html
windows7-x64
1resources/...x.html
windows10-2004-x64
1resources/...min.js
windows7-x64
1resources/...min.js
windows10-2004-x64
1setup.exe
windows7-x64
10setup.exe
windows10-2004-x64
10General
-
Target
Setup.zip
-
Size
2.8MB
-
Sample
221028-jspblafdbn
-
MD5
a5cc58a5680ce0a935c0e8dde8b0e95b
-
SHA1
f3e4be68f4412b358b95eb41fe0b823c2ecbd6df
-
SHA256
039c7deb147774e9f48a601c75c9345b23b435058cbe5ced19a79990a3796885
-
SHA512
9f13562b9845284da8d76a98fcee8b338128ad3617798989c208d8b71420972ac755a4204349830d4a0c86766c2ffa1b5f644248e88926b100c77552985c5931
-
SSDEEP
49152:+Lr3iQ1IlvarS3w1TIPpxStLBFen7PYBuxCxweui:orIlyIesPU7enzPdi
Behavioral task
behavioral1
Sample
packages/Assets/About.pdf
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
packages/Assets/About.pdf
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
packages/Assets/Assets.xml
Resource
win7-20220901-en
Behavioral task
behavioral4
Sample
packages/Assets/Assets.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
resources/AdobePIM.dll
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
resources/AdobePIM.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
resources/carousel/carousel.js
Resource
win7-20220901-en
Behavioral task
behavioral8
Sample
resources/carousel/carousel.js
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
resources/carousel/index.html
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
resources/carousel/index.html
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
resources/carousel/lib/jquery.min.js
Resource
win7-20220901-en
Behavioral task
behavioral12
Sample
resources/carousel/lib/jquery.min.js
Resource
win10v2004-20220812-en
Behavioral task
behavioral13
Sample
setup.exe
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
setup.exe
Resource
win10v2004-20220901-en
Malware Config
Extracted
redline
162.55.165.128:44351
-
auth_value
9bf806ca8cacea2922eb02ed6c42029a
Targets
-
-
Target
packages/Assets/About.pdf
-
Size
185KB
-
MD5
f8e98d604f7c63275ee8739708345baf
-
SHA1
218bb6ab3a6b4899c22ae798691c30acfe423a7c
-
SHA256
dafccfc02c2ad502683ddf61224d6d66eba1e6d5ba13a92b15381af51bb4715a
-
SHA512
05076043c463a3483cd6be000407ba6a5641413a4e0928b2ea1f6ab84bf2b1244c6737b221be7dc9db7a1ea8fc5ea2c34782307babe77916d33ae6cb19b6de05
-
SSDEEP
3072:GdbzlBgmxq3pSxw8FE92HVePu0kiFRiNifT9hQfmRcUQ88k4YLs3L2yFAVxVRjKm:GdbvTq3Mk21GuUFENYTsmRcOoY46yFAV
Score1/10 -
-
-
Target
packages/Assets/Assets.sig
-
Size
1KB
-
MD5
230955481388f2c0f33bedbf0a34aec2
-
SHA1
c3215ac5986e79f62ad4d547e733647c4ffa22a0
-
SHA256
312fc9721a900f9407009f56881ee337ebdb3c5b563d235ac5b2b4b4d2712132
-
SHA512
a4b60dc3839b9a65e1122e397d4b6ba29ab94e59da5ba459a00d61bd8b912162be6ec72ed0c2398aa2f89258b3054e8c6471cbc4a325010251152a8332051acc
Score1/10 -
-
-
Target
resources/AdobePIM.dll
-
Size
2.1MB
-
MD5
7efc2b6852333d9ebac124d4844ba2af
-
SHA1
23c4a09cd6a63850c94109b7b8cbbc197f38931d
-
SHA256
7917708a9f343067e01242423eaa73ae981e20ce07ace6274fdcc71ee2b03b51
-
SHA512
0f9448baa5d1988c14e9b887fcf0491ad49bbdcb808d430a78e78de0e0cfa7a459988dde1a1e58413e621fc732af940a2d6d921a9d599dc495ace4e55f749c48
-
SSDEEP
49152:vDMuoV5iuRXAySHAf5rXXqEkZd78HGP1zQTThZOq1MSGY:vIuoVZDPrXXqEkZd78Hvyl4
Score4/10 -
-
-
Target
resources/carousel/carousel.js
-
Size
2KB
-
MD5
a601c21f7d83cdac2e7452c84d115118
-
SHA1
f6c32160478154439b5d6cbd9baae690775af436
-
SHA256
ce7aa34c7980559bf8032e777bdd68d74075acf957bb171ceacbfd3ba3154706
-
SHA512
f459656dc5e1070404d0704a314072965fa115c3b4a48b394d5bce659f28833053a405ad4dc9df29fe5d012bd178cbff5948ee92bccbca22d6599f48f164b955
Score1/10 -
-
-
Target
resources/carousel/index.html
-
Size
2KB
-
MD5
4ae648f880552834e7b1eb9cd143c974
-
SHA1
41b24162122c6f4a284e7fd48d95b3a600edb638
-
SHA256
3272e9022f5f25c56d7a54df2f03aafcb1cc8519e9db41af7d8d3a3c63e88cc2
-
SHA512
9ed106d6a490c195c708700a48bbf447ee46f496e6e53ab5ece90d5bc1cb18638b53ceea289a1b5b482f0c8bb7fbaa735f6eee7d8bcdec75c8c4f09464b1de3b
Score1/10 -
-
-
Target
resources/carousel/lib/jquery.min.js
-
Size
91KB
-
MD5
e1288116312e4728f98923c79b034b67
-
SHA1
8b6babff47b8a9793f37036fd1b1a3ad41d38423
-
SHA256
ba6eda7945ab8d7e57b34cc5a3dd292fa2e4c60a5ced79236ecf1a9e0f0c2d32
-
SHA512
bf28a9a446e50639a9592d7651f89511fc4e583e213f20a0dff3a44e1a7d73ceefdb6597db121c7742bde92410a27d83d92e2e86466858a19803e72a168e5656
-
SSDEEP
1536:96IzxETpavYSGaW4snuHEk/yosnSFngC/VEEG0vd0KO4emAp2LSEMBoviR+I1z5T:v+vIklosn/BLXjxzMhsSQ
Score1/10 -
-
-
Target
setup.exe
-
Size
700.7MB
-
MD5
57e4031965fdd341dc34ef5907a4f7cc
-
SHA1
0bfc11148c9afb90347862ced51b9466f3e45c00
-
SHA256
28a791d65617efbd41362ed4730c31da5f31ab38b801ff934c942a8bb9f14376
-
SHA512
2881c5426dffd96909ff6c692b18f4016dd7c89601a06b68b2a6e352412fa8debc677d10fe75e5fec3ff68c3af4998ef2f3bd6261f4a708feb71ba2d9f49e5cc
-
SSDEEP
6144:ZSp46tcoUqthb5XHuPllnUdfOZIA6EDXW8jOD/gSegqA6/lkw3RRNxNjfOBXxcMe:ZSNOoXlHuPllncfAW77gSeNWwStA
Score10/10-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Uses the VBS compiler for execution
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Suspicious use of SetThreadContext
-