General
-
Target
Installer.exe
-
Size
250KB
-
Sample
230322-k3wdbsfh88
-
MD5
02b87d3f53c5cbdc2c18cc6c0e6836d8
-
SHA1
ccc7236e49f8bf1e437fcc9ec9539d9bb78b6f3f
-
SHA256
c7d7fe67014e4b96abd6b5215ade5a86ba18abeca44cd6416586d142281a2b7a
-
SHA512
79fcc8954851d94f2e63dc9adba4de396f06325e4ca40892873214cf04467195dac37c3ce8dc3eb877875692b2b1d4b2de850614d2e8a73fc5b960300af05ea7
-
SSDEEP
6144:GTaVWjAfT2UEfO2uwPlyR3EsGY/uyRvm4UPV:oaVWjeIfOJR3EsGYWyBs
Static task
static1
Behavioral task
behavioral1
Sample
Installer.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Installer.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
@Qup1x
45.15.156.155:80
-
auth_value
09785267dffbe1103f18cf1d089a98e3
Targets
-
-
Target
Installer.exe
-
Size
250KB
-
MD5
02b87d3f53c5cbdc2c18cc6c0e6836d8
-
SHA1
ccc7236e49f8bf1e437fcc9ec9539d9bb78b6f3f
-
SHA256
c7d7fe67014e4b96abd6b5215ade5a86ba18abeca44cd6416586d142281a2b7a
-
SHA512
79fcc8954851d94f2e63dc9adba4de396f06325e4ca40892873214cf04467195dac37c3ce8dc3eb877875692b2b1d4b2de850614d2e8a73fc5b960300af05ea7
-
SSDEEP
6144:GTaVWjAfT2UEfO2uwPlyR3EsGY/uyRvm4UPV:oaVWjeIfOJR3EsGYWyBs
Score10/10-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Suspicious use of SetThreadContext
-