General
-
Target
1a052ec0f7d517e57d985af90cebb4ff3cec8b56
-
Size
261KB
-
Sample
230102-pvw24shc5s
-
MD5
90adabace0ebc07b3d7aad1ca388198c
-
SHA1
1a052ec0f7d517e57d985af90cebb4ff3cec8b56
-
SHA256
b708e7bd7a6aa2a217b89fbeb9faa15f9eb620a36e7e12ea820b26249d1b3dda
-
SHA512
aab278f4e4684b42ed7c2efca64e597a213c9fa7b170fe585e11f1d0d46836ba7643ecebaaa215243b405014e9d49f39254fc7a55b1cb68d5ba36b1f1fc1e80d
-
SSDEEP
6144:QKL9ysoWI3xpQnlJK30ll9VaV2QTOqQmbY/PGkk:QmylxpClgK9cXSlC4+
Static task
static1
Behavioral task
behavioral1
Sample
1a052ec0f7d517e57d985af90cebb4ff3cec8b56.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
1a052ec0f7d517e57d985af90cebb4ff3cec8b56.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
redline
@flomast
82.115.223.138:35316
-
auth_value
f81873a4b6883da83f3937093ca68161
Targets
-
-
Target
1a052ec0f7d517e57d985af90cebb4ff3cec8b56
-
Size
261KB
-
MD5
90adabace0ebc07b3d7aad1ca388198c
-
SHA1
1a052ec0f7d517e57d985af90cebb4ff3cec8b56
-
SHA256
b708e7bd7a6aa2a217b89fbeb9faa15f9eb620a36e7e12ea820b26249d1b3dda
-
SHA512
aab278f4e4684b42ed7c2efca64e597a213c9fa7b170fe585e11f1d0d46836ba7643ecebaaa215243b405014e9d49f39254fc7a55b1cb68d5ba36b1f1fc1e80d
-
SSDEEP
6144:QKL9ysoWI3xpQnlJK30ll9VaV2QTOqQmbY/PGkk:QmylxpClgK9cXSlC4+
Score10/10-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Suspicious use of SetThreadContext
-