General

  • Target
    Dr. Fone 11.4.1 Crack Key Torrent (Reg Code) Full Version Downloader.exe
  • Size 399KB
  • Sample221202-fgvsfsee95
  • SHA256 bc4e6b5f7f8d7765fb865b1dda3803c9a6d53e45777ffdacc5e50b3c7f9b8d9a
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • redline

Botnet
  • LX2610

C2
  • 77.73.134.2:24200

Attributes
  • auth_value

    f768f528a86417d167cbd729de75299e

Targets

    • Target
      Dr. Fone 11.4.1 Crack Key Torrent (Reg Code) Full Version Downloader.exe
    • Size 399KB
    • SHA256 bc4e6b5f7f8d7765fb865b1dda3803c9a6d53e45777ffdacc5e50b3c7f9b8d9a
    • MD5 SHA1 SHA512 SSDEEP
    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • UAC bypass

    • Windows security bypass

    • Sets service image path in registry

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks whether UAC is enabled

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks