General
-
Target
8e2939be4a35e5f3ceab0342b20b0a7ab4415f8ab035ac47301ebec3f8caf8b7
-
Size
601KB
-
Sample
230204-k4279sda39
-
MD5
85f3d3d780112dcecaad57d890be460a
-
SHA1
d743725f17c81a0eb33af44d52a288b8133a4a53
-
SHA256
8e2939be4a35e5f3ceab0342b20b0a7ab4415f8ab035ac47301ebec3f8caf8b7
-
SHA512
e6bd7f84ed539332f37c0624d3c9dcf792ad2532952ca06d0369fc54ac6b5c3b09fd65047adcd1d19a849bb6db4ce6189b4d6be4bf1415a446236104d77321e4
-
SSDEEP
12288:WKdEMGaYbLuU4XeHLL8jCUd5e/mQJ5QjAWUmKFx7B:W8GUmX1UGOQYs57x7B
Static task
static1
Behavioral task
behavioral1
Sample
8e2939be4a35e5f3ceab0342b20b0a7ab4415f8ab035ac47301ebec3f8caf8b7.exe
Resource
win10v2004-20221111-en
Malware Config
Extracted
redline
redko
62.204.41.170:4179
-
auth_value
9bcf7b0620ff067017d66b9a5d80b547
Extracted
amadey
3.66
62.204.41.5/Bu58Ngs/index.php
Extracted
redline
temposs6678
82.115.223.9:15486
-
auth_value
af399e6a2fe66f67025541cf71c64313
Targets
-
-
Target
8e2939be4a35e5f3ceab0342b20b0a7ab4415f8ab035ac47301ebec3f8caf8b7
-
Size
601KB
-
MD5
85f3d3d780112dcecaad57d890be460a
-
SHA1
d743725f17c81a0eb33af44d52a288b8133a4a53
-
SHA256
8e2939be4a35e5f3ceab0342b20b0a7ab4415f8ab035ac47301ebec3f8caf8b7
-
SHA512
e6bd7f84ed539332f37c0624d3c9dcf792ad2532952ca06d0369fc54ac6b5c3b09fd65047adcd1d19a849bb6db4ce6189b4d6be4bf1415a446236104d77321e4
-
SSDEEP
12288:WKdEMGaYbLuU4XeHLL8jCUd5e/mQJ5QjAWUmKFx7B:W8GUmX1UGOQYs57x7B
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-