General
-
Target
b3ff63cd16aa29ca9aa40fc9f6fd7df3721044a01c13adec001903069a9a8b3a
-
Size
839KB
-
Sample
230204-kvka4ach95
-
MD5
1ce40e5c49619679074af5fb03cb9346
-
SHA1
52f0c11fd7de9ce7f13ae8bb6823e284e9f7e6be
-
SHA256
b3ff63cd16aa29ca9aa40fc9f6fd7df3721044a01c13adec001903069a9a8b3a
-
SHA512
893bceacf9337952da78a6a745f7b1aff16888fe27e8960a16ab00adeeaf9adfef8e8486cae4a697c364f382ca0a09e49cb31c54c6e7aa1f5492e5f8e9788a6a
-
SSDEEP
12288:XmZqrfd7yCmBstUCfZwnL34wuiMevqTwV97jtqRT6begUu5RDkbfyhZ79+X:Xlfi1sob4n72V9NqEb1f7wfO9+X
Static task
static1
Behavioral task
behavioral1
Sample
b3ff63cd16aa29ca9aa40fc9f6fd7df3721044a01c13adec001903069a9a8b3a.exe
Resource
win10v2004-20221111-en
Malware Config
Extracted
redline
redko
62.204.41.170:4179
-
auth_value
9bcf7b0620ff067017d66b9a5d80b547
Extracted
amadey
3.66
62.204.41.5/Bu58Ngs/index.php
Extracted
redline
temposs6678
82.115.223.9:15486
-
auth_value
af399e6a2fe66f67025541cf71c64313
Targets
-
-
Target
b3ff63cd16aa29ca9aa40fc9f6fd7df3721044a01c13adec001903069a9a8b3a
-
Size
839KB
-
MD5
1ce40e5c49619679074af5fb03cb9346
-
SHA1
52f0c11fd7de9ce7f13ae8bb6823e284e9f7e6be
-
SHA256
b3ff63cd16aa29ca9aa40fc9f6fd7df3721044a01c13adec001903069a9a8b3a
-
SHA512
893bceacf9337952da78a6a745f7b1aff16888fe27e8960a16ab00adeeaf9adfef8e8486cae4a697c364f382ca0a09e49cb31c54c6e7aa1f5492e5f8e9788a6a
-
SSDEEP
12288:XmZqrfd7yCmBstUCfZwnL34wuiMevqTwV97jtqRT6begUu5RDkbfyhZ79+X:Xlfi1sob4n72V9NqEb1f7wfO9+X
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-