General
-
Target
af4eeaad90b517e600570110754d9c5e.bin
-
Size
998KB
-
Sample
230326-cahyjafb57
-
MD5
2d3ebe51fc7577b90ce2ff558febc4b7
-
SHA1
7600bce78e676c6bad0057b2927b84cd47439335
-
SHA256
b9c3f718a13937db2c15eecd8428e5c4467721c5270bcd13abdcf488bb861bc8
-
SHA512
03d5a53eb05d4cb51c19503ea38d4dfeeeda354765787f9fb920ebe7b713ddce54e349462c7b82824636d6a449673e5931941ba13062f0a5fdfd71ba9aae8bb6
-
SSDEEP
24576:gB+SooPLAhQZH0lhZ6NcPdDNZFzG/yZBGSWKv5U:gzoGLAmtChZ6NcKyKlaU
Static task
static1
Behavioral task
behavioral1
Sample
4ec8aad55df3e8ec8764a710e2613c8c160cf176653ab6c38c65fd0ac9892164.exe
Resource
win7-20230220-en
Malware Config
Extracted
redline
boris
193.233.20.32:4125
-
auth_value
766b5bdf6dbefcf7ca223351952fc38f
Extracted
redline
lida
193.233.20.32:4125
-
auth_value
24052aa2e9b85984a98d80cf08623e8d
Extracted
amadey
3.68
62.204.41.87/joomla/index.php
Extracted
redline
@REDLINEVIPCHAT Cloud (TG: @FATHEROFCARDERS)
151.80.89.234:19388
-
auth_value
56af49c3278d982f9a41ef2abb7c4d09
Extracted
redline
ngan003
199.115.193.116:11300
-
auth_value
b500a5cf0cb429e32a81c6ddcd8d4545
Targets
-
-
Target
4ec8aad55df3e8ec8764a710e2613c8c160cf176653ab6c38c65fd0ac9892164.exe
-
Size
1.0MB
-
MD5
af4eeaad90b517e600570110754d9c5e
-
SHA1
3541b188739c9a8f410e72e2bd83fb13f7f5d3e7
-
SHA256
4ec8aad55df3e8ec8764a710e2613c8c160cf176653ab6c38c65fd0ac9892164
-
SHA512
69364903c3e497785f37cdb336a9c2be9ee3fb00348e3db73efa99af771425d6edfba1144727cf377d899291a8f28ea1a850ffaa99bd6eca44186e07b24b3fb6
-
SSDEEP
12288:/Mr+y90uWN7tjy9h/hBCuOmhSG6HC5/C75PRt2V7frgpGNmcxaUzxhPt2dWQzke5:Rya9Fy9hJB1r56tPXGNmcsU7EaN8V
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-