General
- Target Dr. Fone 11.4.1 Crack Key Torrent (Reg Code) Full Version Downloader.exe
- Size 399KB
- Sample221202-fgvsfsee95
- SHA256 bc4e6b5f7f8d7765fb865b1dda3803c9a6d53e45777ffdacc5e50b3c7f9b8d9a
- MD5 27482f80b6d1ed6c898049a68f93a363
- SHA1 e067fa6d3937dc8ff5bcd871fd837e4bffa6065b
- SHA512 23b1543bb9588cb3f44b14332195133de6e81a7d2847ab5d75f3f8ad435d6b1e36d6ca60e9e24a438c3e058d954e372300fa60abe68137a8531fa4c6d54dd8f9
- SSDEEP 12288:k1kWZoqsz7Q/UMbTlOncXSl1Q/jE/21dbb:KsclOcCfQreyxb
- MD5 SHA1 SHA512 SSDEEP
Static task
static1
Behavioral task
behavioral1
Sample
Dr. Fone 11.4.1 Crack Key Torrent (Reg Code) Full Version Downloader.exe
Resource
win7-20221111-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
Dr. Fone 11.4.1 Crack Key Torrent (Reg Code) Full Version Downloader.exe
Resource
win10v2004-20221111-en
16 signatures
150 seconds
Malware Config
Extracted
Family
-
redline
Botnet
-
LX2610
C2
-
77.73.134.2:24200
Attributes
-
auth_value
f768f528a86417d167cbd729de75299e
Targets
-
- Target Dr. Fone 11.4.1 Crack Key Torrent (Reg Code) Full Version Downloader.exe
- Size 399KB
- SHA256 bc4e6b5f7f8d7765fb865b1dda3803c9a6d53e45777ffdacc5e50b3c7f9b8d9a
- MD5 27482f80b6d1ed6c898049a68f93a363
- SHA1 e067fa6d3937dc8ff5bcd871fd837e4bffa6065b
- SHA512 23b1543bb9588cb3f44b14332195133de6e81a7d2847ab5d75f3f8ad435d6b1e36d6ca60e9e24a438c3e058d954e372300fa60abe68137a8531fa4c6d54dd8f9
- SSDEEP 12288:k1kWZoqsz7Q/UMbTlOncXSl1Q/jE/21dbb:KsclOcCfQreyxb
- MD5 SHA1 SHA512 SSDEEP
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Sets service image path in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Suspicious use of SetThreadContext