General
-
Target
modest-menu.exe
-
Size
272KB
-
Sample
230312-ebl3paee8x
-
MD5
1a1c3d59d98acae1cbb61d7684f23630
-
SHA1
c460bb203135a1501ed262ad0942e31e00b120c1
-
SHA256
78a85115cf45f7aa9a78d2c858b38901f62c912372dd8fe02d9fc1d157d51b0d
-
SHA512
0325bed426b96d57ea0820fb444e21f726b486cf9bebc10573d5c0bd917cf070c38472329eb07357f885e280b22b0b7d13f29dc17e73c133671b91f4df29b680
-
SSDEEP
3072:Z3+SWzM3wrqc306QxK7JylrH4omPLRGy/0hUK17jfTQBT+JXbtGaktN2cCej9OTv:Z3+SWzM36k6QxunBmwilBGR/9a+IB
Static task
static1
Behavioral task
behavioral1
Sample
modest-menu.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
modest-menu.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
45.15.157.131:36457
-
auth_value
e2b8fca520cd9a12cc348212c33d4ea6
Targets
-
-
Target
modest-menu.exe
-
Size
272KB
-
MD5
1a1c3d59d98acae1cbb61d7684f23630
-
SHA1
c460bb203135a1501ed262ad0942e31e00b120c1
-
SHA256
78a85115cf45f7aa9a78d2c858b38901f62c912372dd8fe02d9fc1d157d51b0d
-
SHA512
0325bed426b96d57ea0820fb444e21f726b486cf9bebc10573d5c0bd917cf070c38472329eb07357f885e280b22b0b7d13f29dc17e73c133671b91f4df29b680
-
SSDEEP
3072:Z3+SWzM3wrqc306QxK7JylrH4omPLRGy/0hUK17jfTQBT+JXbtGaktN2cCej9OTv:Z3+SWzM36k6QxunBmwilBGR/9a+IB
Score10/10-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Suspicious use of SetThreadContext
-