General
-
Target
24eac4d7f6e628d7cf291e8e1b39f5d2cc091578b05cfba301dc58709a1a2109
-
Size
3.1MB
-
Sample
221206-phra4age65
-
MD5
1cd91de8f373882db0e2293f468544c8
-
SHA1
ff788f0bdbcc0e5951dc4b1f60c21d6dcfa7c90a
-
SHA256
24eac4d7f6e628d7cf291e8e1b39f5d2cc091578b05cfba301dc58709a1a2109
-
SHA512
20cda0f10e9e01e09d75eba4724b060b2300ea707da33e12c1853c623311c54b038e21250b6bd68716b85f861bd7278949e00a58894f57418cacc021e5a21d62
-
SSDEEP
49152:zF1vNuhz6lqOEBsZEFDMEPrNeRfy8AJx4GV6UHRtLTwsOwu3B3WwepUBe1R:p1FuhzbsZMAEP0f3AXAUnosO/x3WSg
Static task
static1
Behavioral task
behavioral1
Sample
24eac4d7f6e628d7cf291e8e1b39f5d2cc091578b05cfba301dc58709a1a2109.exe
Resource
win7-20220812-en
Malware Config
Extracted
redline
11-25
172.99.189.117:44670
-
auth_value
f3754aeb17f33c672540bd6f71407965
Targets
-
-
Target
24eac4d7f6e628d7cf291e8e1b39f5d2cc091578b05cfba301dc58709a1a2109
-
Size
3.1MB
-
MD5
1cd91de8f373882db0e2293f468544c8
-
SHA1
ff788f0bdbcc0e5951dc4b1f60c21d6dcfa7c90a
-
SHA256
24eac4d7f6e628d7cf291e8e1b39f5d2cc091578b05cfba301dc58709a1a2109
-
SHA512
20cda0f10e9e01e09d75eba4724b060b2300ea707da33e12c1853c623311c54b038e21250b6bd68716b85f861bd7278949e00a58894f57418cacc021e5a21d62
-
SSDEEP
49152:zF1vNuhz6lqOEBsZEFDMEPrNeRfy8AJx4GV6UHRtLTwsOwu3B3WwepUBe1R:p1FuhzbsZMAEP0f3AXAUnosO/x3WSg
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-