General
-
Target
file.exe
-
Size
659KB
-
Sample
230310-xvcmgafa28
-
MD5
488720af6f69c898d6d6395031aa85c3
-
SHA1
3fe4bc5bf1c4b247387f26b979b61f134f559c2d
-
SHA256
08d2b92fdb25dbb96377425688b7489e27364ef8f999dd39277fef64a2184127
-
SHA512
6aad84e73cc920954f10b6ca24ca990def4a0a1084ff9d9ba1446662be346330ee212d8baaffc44ceb98dea3b7122a92c1d3655ac7985a61f92f9e61af0d5714
-
SSDEEP
12288:vC3KnP4KDfTKXDOMfEMy7C8Nqj0LuF4mw746ovRNuwf6vV:vtPBmCCu7XN4044mwEvHuwfK
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
gonna
193.56.146.220:4174
-
auth_value
10ce5127fa09a5422f1a407fb6a7c077
Extracted
amadey
3.68
193.56.146.218/images/IMG_489440/index.php
Targets
-
-
Target
file.exe
-
Size
659KB
-
MD5
488720af6f69c898d6d6395031aa85c3
-
SHA1
3fe4bc5bf1c4b247387f26b979b61f134f559c2d
-
SHA256
08d2b92fdb25dbb96377425688b7489e27364ef8f999dd39277fef64a2184127
-
SHA512
6aad84e73cc920954f10b6ca24ca990def4a0a1084ff9d9ba1446662be346330ee212d8baaffc44ceb98dea3b7122a92c1d3655ac7985a61f92f9e61af0d5714
-
SSDEEP
12288:vC3KnP4KDfTKXDOMfEMy7C8Nqj0LuF4mw746ovRNuwf6vV:vtPBmCCu7XN4044mwEvHuwfK
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-