General
-
Target
8ceb3e5ac71e9c98006f36608b2c33706e00a5eaaa69fc0dee304fc89abae50b.zip
-
Size
188KB
-
Sample
221114-ll6y6sbc3w
-
MD5
1ee082a9f33acbee704e7be4f0c4bf02
-
SHA1
6c98365ed8fd733934e4b87831409d9855f42302
-
SHA256
8c8ed0517da6e06d365166e3dc12308fad3e90ca6607c7c94c1a7fdf71428f0e
-
SHA512
b9bba1a7f2870bfd26ff49174a7782266541140efb7bc4a6a5ad0b974d0ec962a315a37067ab3622f0cee9e66c3f3d04d1cadba4841d10de02cd45349d53f219
-
SSDEEP
3072:4UqLOxMoa8pgNlnDcNDDzvHfrzErQkOye/Uox247lgv0bLCCve2mNYgBFTPRJSDk:4UyglgDGDDzXUQDye/fx298bdcBTJWpe
Static task
static1
Behavioral task
behavioral1
Sample
8ceb3e5ac71e9c98006f36608b2c33706e00a5eaaa69fc0dee304fc89abae50b.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
8ceb3e5ac71e9c98006f36608b2c33706e00a5eaaa69fc0dee304fc89abae50b.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
redline
boy
77.73.134.241:4691
-
auth_value
a91fa8cc2cfaefc42a23c03faef44bd3
Targets
-
-
Target
8ceb3e5ac71e9c98006f36608b2c33706e00a5eaaa69fc0dee304fc89abae50b.exe
-
Size
248KB
-
MD5
908564324457fbae5493c6b6b862a1c0
-
SHA1
75c6e69ce15e3c77de5b2af9218b769be0608dbf
-
SHA256
8ceb3e5ac71e9c98006f36608b2c33706e00a5eaaa69fc0dee304fc89abae50b
-
SHA512
2a6e6efacb86a397e2ce0f85deee59d24dd958ec4b935b70fa56e3fd4b97f71c5f306704b10f3effc3b76a4066dd88ca70cfe6b66fcd595cff2bdc3aa778892a
-
SSDEEP
3072:LUX4170EsHLj/0KGW31RvWkumJUIP/GTja52TS3rKJjz+8LKrS56uZY:E41QDLz0KGWTWkuG3P/dcTErGC8ASYc
-
Detect Amadey credential stealer module
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-