General
-
Target
6b8c79bb8e2a5131af6c122320f1dfa0de1672f6
-
Size
7.5MB
-
Sample
230103-hfqhfsad77
-
MD5
1eb2ae579489e4c883f85747a7d2c9fa
-
SHA1
6b8c79bb8e2a5131af6c122320f1dfa0de1672f6
-
SHA256
39492736e783427a68a791ca3d17fa3bad096cda54846bbf54e53ab3bb0f2633
-
SHA512
09566ef57edb4f3e16fc6fce66f672f9fe202779e637b9ad04e8b4d9a8b54bbbfe618fffe8b3a7fc68d15ae48449675089f40260ab09396a670bd5cfe2abab6c
-
SSDEEP
98304:4w6Tks8Ip9y88/gE1k8cIjNnoeXsU11HK3rt2avguB4et/vEw4KLOqcCLj1J1cNE:47Tks8I78bkKjNnjsU11g
Static task
static1
Behavioral task
behavioral1
Sample
6b8c79bb8e2a5131af6c122320f1dfa0de1672f6.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
6b8c79bb8e2a5131af6c122320f1dfa0de1672f6.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
redline
UniverseCity100
80.89.228.168:5007
-
auth_value
a16f64012f1825f5b9cc033dc35b580f
Targets
-
-
Target
6b8c79bb8e2a5131af6c122320f1dfa0de1672f6
-
Size
7.5MB
-
MD5
1eb2ae579489e4c883f85747a7d2c9fa
-
SHA1
6b8c79bb8e2a5131af6c122320f1dfa0de1672f6
-
SHA256
39492736e783427a68a791ca3d17fa3bad096cda54846bbf54e53ab3bb0f2633
-
SHA512
09566ef57edb4f3e16fc6fce66f672f9fe202779e637b9ad04e8b4d9a8b54bbbfe618fffe8b3a7fc68d15ae48449675089f40260ab09396a670bd5cfe2abab6c
-
SSDEEP
98304:4w6Tks8Ip9y88/gE1k8cIjNnoeXsU11HK3rt2avguB4et/vEw4KLOqcCLj1J1cNE:47Tks8I78bkKjNnjsU11g
Score10/10-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Suspicious use of SetThreadContext
-