General
-
Target
dca51e89de423f30411f9895dce7f1ef.exe
-
Size
398KB
-
Sample
221225-khkq4aed8z
-
MD5
dca51e89de423f30411f9895dce7f1ef
-
SHA1
fb542585959bedf3040c1ecaf59cd5e72eed7346
-
SHA256
3ca4879853a8f13a89473cb07e7ae77ab830abbf0ea5e09b3f525c5810b153b9
-
SHA512
6d231a7c1f3e29839deb57bdd44c03f61b628a974542b89d26664adc0b8a2029cef6e93a8326e163d8a952e24ce407c60aa7937bc4a594747dd1e70ef4c9e0ea
-
SSDEEP
6144:gygxer6dluLigEBBY2o1FhZRVPjGAOHJaopm1sshCv8DwcM6FoGP7:gygxer6dluLigEZoNZaza2shK8XzP7
Static task
static1
Behavioral task
behavioral1
Sample
dca51e89de423f30411f9895dce7f1ef.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
dca51e89de423f30411f9895dce7f1ef.exe
Resource
win10v2004-20221111-en
Malware Config
Extracted
redline
11
79.137.202.18:45218
-
auth_value
107e09eee63158d2488feb03dac75204
Targets
-
-
Target
dca51e89de423f30411f9895dce7f1ef.exe
-
Size
398KB
-
MD5
dca51e89de423f30411f9895dce7f1ef
-
SHA1
fb542585959bedf3040c1ecaf59cd5e72eed7346
-
SHA256
3ca4879853a8f13a89473cb07e7ae77ab830abbf0ea5e09b3f525c5810b153b9
-
SHA512
6d231a7c1f3e29839deb57bdd44c03f61b628a974542b89d26664adc0b8a2029cef6e93a8326e163d8a952e24ce407c60aa7937bc4a594747dd1e70ef4c9e0ea
-
SSDEEP
6144:gygxer6dluLigEBBY2o1FhZRVPjGAOHJaopm1sshCv8DwcM6FoGP7:gygxer6dluLigEZoNZaza2shK8XzP7
Score10/10-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Uses the VBS compiler for execution
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Suspicious use of SetThreadContext
-