General
-
Target
2981f1f63877385d6dbc8e9f8a00b89d5eca9ef507dc537ff062269c63ebfe02
-
Size
1.2MB
-
Sample
230224-bst8vahg44
-
MD5
603a98f285802639dad3c7f00bdc3cfb
-
SHA1
778a56667155e16c54d1099fa1e420bc81e65116
-
SHA256
2981f1f63877385d6dbc8e9f8a00b89d5eca9ef507dc537ff062269c63ebfe02
-
SHA512
35100608bb439c1a529a5840b3241357c8aa2a3bc254c1afdec67ef980f4882b5d0e626bea29cbbd37560f4c8393a62b3ee7bba4bcc95739c11e7ec0b60a6dca
-
SSDEEP
24576:KyWYJGxWE4YeZ8orDpjVns23xcVy+VEbiWqr4oNrI+:RHJGxWE4Z88Vxs2xc0GGi+oy
Static task
static1
Malware Config
Extracted
redline
ronur
193.233.20.20:4134
-
auth_value
f88f86755a528d4b25f6f3628c460965
Extracted
redline
funka
193.233.20.20:4134
-
auth_value
cdb395608d7ec633dce3d2f0c7fb0741
Extracted
amadey
3.67
193.233.20.15/dF30Hn4m/index.php
specialblue.in/dF30Hn4m/index.php
specialblue.pm/dF30Hn4m/index.php
specialblue.wf/dF30Hn4m/index.php
Extracted
amadey
3.66
62.204.41.88/9vdVVVjsw/index.php
Extracted
amadey
3.65
hellomr.observer/7gjD0Vs3d/index.php
researchersgokick.rocks/7gjD0Vs3d/index.php
pleasetake.pictures/7gjD0Vs3d/index.php
Extracted
redline
Thomas
107.189.165.102:1919
-
auth_value
1a3e158dd21f084bceada6f65fc00a1c
Targets
-
-
Target
2981f1f63877385d6dbc8e9f8a00b89d5eca9ef507dc537ff062269c63ebfe02
-
Size
1.2MB
-
MD5
603a98f285802639dad3c7f00bdc3cfb
-
SHA1
778a56667155e16c54d1099fa1e420bc81e65116
-
SHA256
2981f1f63877385d6dbc8e9f8a00b89d5eca9ef507dc537ff062269c63ebfe02
-
SHA512
35100608bb439c1a529a5840b3241357c8aa2a3bc254c1afdec67ef980f4882b5d0e626bea29cbbd37560f4c8393a62b3ee7bba4bcc95739c11e7ec0b60a6dca
-
SSDEEP
24576:KyWYJGxWE4YeZ8orDpjVns23xcVy+VEbiWqr4oNrI+:RHJGxWE4Z88Vxs2xc0GGi+oy
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-