General
-
Target
0e33b9e1a35c18a87afd29b937ea7e04c246392939c616bd17c448632163aa8e
-
Size
243KB
-
Sample
221114-vr9fxsha5s
-
MD5
9b0936252bda998f49ad020f969131ea
-
SHA1
47e5fcb9b0e2d4386e51e716e2c81393fbb90c8e
-
SHA256
f53f618f8a7d3d4bdbd47df1a396b6a7a9fb46a5ebd0785bfaab24c29c4e0e18
-
SHA512
fd70e5b96102c955a19e9fa320048500331555f88193ab786ca18e8615e85182e85aeae2c4afbefca8ecca5fe58304d13eba80cd5a5cdfdd51f2245326ecadd4
-
SSDEEP
6144:5XILkXSF7sEcQH4Lu58vO3m7eQeEZz8pZIp3zJ:q9VEZr7fXr3zJ
Static task
static1
Behavioral task
behavioral1
Sample
0e33b9e1a35c18a87afd29b937ea7e04c246392939c616bd17c448632163aa8e.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
0e33b9e1a35c18a87afd29b937ea7e04c246392939c616bd17c448632163aa8e.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
redline
boy
77.73.134.241:4691
-
auth_value
a91fa8cc2cfaefc42a23c03faef44bd3
Extracted
redline
@REDLINEVIP Cloud (TG: @FATHEROFCARDERS)
151.80.89.233:13553
-
auth_value
fbee175162920530e6bf470c8003fa1a
Targets
-
-
Target
0e33b9e1a35c18a87afd29b937ea7e04c246392939c616bd17c448632163aa8e
-
Size
346KB
-
MD5
94cfb05ebec8347824c6a47b1f134cf1
-
SHA1
be422dfc6d32411c8e28fb83c0d77eb28103dc9a
-
SHA256
0e33b9e1a35c18a87afd29b937ea7e04c246392939c616bd17c448632163aa8e
-
SHA512
3b7ed9e8cebf8a32180906615d07ed97b16c47aebfd5a18e1778dacbbc8a0889ff0a4a826334e39654e13f6b565340e76dae313aacf1448f9539345a0cb8c130
-
SSDEEP
6144:BkXvLzTOjlPdnarcQH4nu58vk3m7eQj25En2E1a:Bk/fTOj7arVmZd7fjeUv
-
Detect Amadey credential stealer module
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-