General
-
Target
46666096ece6d7c0d0cd3e11eb60291607362dfc6a8ed65a843c9ee0a3091177
-
Size
399KB
-
Sample
221225-n6fc3abe35
-
MD5
d18952fdf658225bf98f98d5f0b39b96
-
SHA1
152d865e5a34cfc366e7b25509aadf32f4738bfb
-
SHA256
46666096ece6d7c0d0cd3e11eb60291607362dfc6a8ed65a843c9ee0a3091177
-
SHA512
6f8202c90afa63e0a7da6933df31b187d2f6fcf6fb9b7ae55e7720730739c161c9a9c9f0d0016f2c7a84633681f461ad9c2b9590b7ca241011fd6800a3c28e14
-
SSDEEP
6144:56DCxLT52vMishn5u9OC9ZjYAO42SksxyBZ04gM4DkfXin8DN:56DCxLT52vMiy7W2Dwkf9N
Static task
static1
Behavioral task
behavioral1
Sample
46666096ece6d7c0d0cd3e11eb60291607362dfc6a8ed65a843c9ee0a3091177.exe
Resource
win10-20220812-en
Malware Config
Extracted
redline
11
79.137.202.18:45218
-
auth_value
107e09eee63158d2488feb03dac75204
Targets
-
-
Target
46666096ece6d7c0d0cd3e11eb60291607362dfc6a8ed65a843c9ee0a3091177
-
Size
399KB
-
MD5
d18952fdf658225bf98f98d5f0b39b96
-
SHA1
152d865e5a34cfc366e7b25509aadf32f4738bfb
-
SHA256
46666096ece6d7c0d0cd3e11eb60291607362dfc6a8ed65a843c9ee0a3091177
-
SHA512
6f8202c90afa63e0a7da6933df31b187d2f6fcf6fb9b7ae55e7720730739c161c9a9c9f0d0016f2c7a84633681f461ad9c2b9590b7ca241011fd6800a3c28e14
-
SSDEEP
6144:56DCxLT52vMishn5u9OC9ZjYAO42SksxyBZ04gM4DkfXin8DN:56DCxLT52vMiy7W2Dwkf9N
Score10/10-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Uses the VBS compiler for execution
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Suspicious use of SetThreadContext
-