General
-
Target
32551f9124a359edf3435979372676a4c5bbaeb0423cc3ec53d382abb39d850f
-
Size
356KB
-
Sample
230103-fet35sda4v
-
MD5
114738737463a73a549ac1221afd045c
-
SHA1
70feebd89e898537d4ccfe2522e29af1568d4e68
-
SHA256
32551f9124a359edf3435979372676a4c5bbaeb0423cc3ec53d382abb39d850f
-
SHA512
b52490e2c5dd34779715580d5eb885011eee17994a104afb6e1f4a10ba629d09494d89748bf18171ae95cd43a7e02211c8bace8c34343b0e889a6c0ed2d8e135
-
SSDEEP
6144:qcJeNaxNPMRWRBlTyw07AOpj/tdOnHOXoZeYvf3Z66dMbsBJV:HeNaxxMRs+7f/td6HOYZeC/ZewBJ
Static task
static1
Behavioral task
behavioral1
Sample
32551f9124a359edf3435979372676a4c5bbaeb0423cc3ec53d382abb39d850f.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
32551f9124a359edf3435979372676a4c5bbaeb0423cc3ec53d382abb39d850f.exe
Resource
win10-20220901-en
Malware Config
Extracted
redline
letgo
80.66.87.13:22346
-
auth_value
9a4217b7e3f4309698e5e6d932e3545e
Targets
-
-
Target
32551f9124a359edf3435979372676a4c5bbaeb0423cc3ec53d382abb39d850f
-
Size
356KB
-
MD5
114738737463a73a549ac1221afd045c
-
SHA1
70feebd89e898537d4ccfe2522e29af1568d4e68
-
SHA256
32551f9124a359edf3435979372676a4c5bbaeb0423cc3ec53d382abb39d850f
-
SHA512
b52490e2c5dd34779715580d5eb885011eee17994a104afb6e1f4a10ba629d09494d89748bf18171ae95cd43a7e02211c8bace8c34343b0e889a6c0ed2d8e135
-
SSDEEP
6144:qcJeNaxNPMRWRBlTyw07AOpj/tdOnHOXoZeYvf3Z66dMbsBJV:HeNaxxMRs+7f/td6HOYZeC/ZewBJ
Score10/10-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Uses the VBS compiler for execution
-
Suspicious use of SetThreadContext
-