General
-
Target
908564324457fbae5493c6b6b862a1c0.exe
-
Size
248KB
-
Sample
221112-jmh8dshe5x
-
MD5
908564324457fbae5493c6b6b862a1c0
-
SHA1
75c6e69ce15e3c77de5b2af9218b769be0608dbf
-
SHA256
8ceb3e5ac71e9c98006f36608b2c33706e00a5eaaa69fc0dee304fc89abae50b
-
SHA512
2a6e6efacb86a397e2ce0f85deee59d24dd958ec4b935b70fa56e3fd4b97f71c5f306704b10f3effc3b76a4066dd88ca70cfe6b66fcd595cff2bdc3aa778892a
-
SSDEEP
3072:LUX4170EsHLj/0KGW31RvWkumJUIP/GTja52TS3rKJjz+8LKrS56uZY:E41QDLz0KGWTWkuG3P/dcTErGC8ASYc
Static task
static1
Behavioral task
behavioral1
Sample
908564324457fbae5493c6b6b862a1c0.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
908564324457fbae5493c6b6b862a1c0.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
redline
boy
77.73.134.241:4691
-
auth_value
a91fa8cc2cfaefc42a23c03faef44bd3
Targets
-
-
Target
908564324457fbae5493c6b6b862a1c0.exe
-
Size
248KB
-
MD5
908564324457fbae5493c6b6b862a1c0
-
SHA1
75c6e69ce15e3c77de5b2af9218b769be0608dbf
-
SHA256
8ceb3e5ac71e9c98006f36608b2c33706e00a5eaaa69fc0dee304fc89abae50b
-
SHA512
2a6e6efacb86a397e2ce0f85deee59d24dd958ec4b935b70fa56e3fd4b97f71c5f306704b10f3effc3b76a4066dd88ca70cfe6b66fcd595cff2bdc3aa778892a
-
SSDEEP
3072:LUX4170EsHLj/0KGW31RvWkumJUIP/GTja52TS3rKJjz+8LKrS56uZY:E41QDLz0KGWTWkuG3P/dcTErGC8ASYc
-
Detect Amadey credential stealer module
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-