General
-
Target
file.exe
-
Size
425KB
-
Sample
221226-x6mxksgh2t
-
MD5
df78d30c9b01313df869cfe857b14f13
-
SHA1
59d6b5b9dca6cd249caa89209bdc781e3da1f050
-
SHA256
dd06232c864c14a9a494b6e023b114e526ea57dcb8366bf9a6248fd68eab2e12
-
SHA512
99dc96b6f9683b9973abc493b71c60289102621af0e20e1355b4462212a9ee66bcd6fdfae21f499940da85b6177e61ebdc9b4d2e94debc80e4fac1e068564144
-
SSDEEP
12288:XuqM5hh3qkzf7rJRd6UI5SnHJ/qnKkgT3:06kXzdDCnKkgL
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
redline
Install
159.223.106.156:81
-
auth_value
f9affed97251c08e7a096257ba9edfb2
Targets
-
-
Target
file.exe
-
Size
425KB
-
MD5
df78d30c9b01313df869cfe857b14f13
-
SHA1
59d6b5b9dca6cd249caa89209bdc781e3da1f050
-
SHA256
dd06232c864c14a9a494b6e023b114e526ea57dcb8366bf9a6248fd68eab2e12
-
SHA512
99dc96b6f9683b9973abc493b71c60289102621af0e20e1355b4462212a9ee66bcd6fdfae21f499940da85b6177e61ebdc9b4d2e94debc80e4fac1e068564144
-
SSDEEP
12288:XuqM5hh3qkzf7rJRd6UI5SnHJ/qnKkgT3:06kXzdDCnKkgL
Score10/10-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Uses the VBS compiler for execution
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Suspicious use of SetThreadContext
-