General
-
Target
2411653655b03e21b87a7684d6ab1539.bin
-
Size
993KB
-
Sample
230328-bldmhsaa7s
-
MD5
7dec39d998706e6ef9a50ed8052972a4
-
SHA1
4ff6ae0f48b3dd0c5eae674fcbd88548b4a46bd4
-
SHA256
a272cf7c05ba66944ee1d4dee2909597d288e00503af388d65981a2f515eda4c
-
SHA512
16d892ea61b884e48f750f3cb343e57cbfaad87497ca87783794b7e0251a14f2830c4c21b14b0f370a2ef6e9da7f5ef7c89f87aa26db65f8fb480fcbe3f9c38d
-
SSDEEP
24576:gIAj0qNAYxxuHGbdC43V3GWeDCH1rk6gYtkXt/8Oq:riqmbdCuVWW11kPXN4
Static task
static1
Behavioral task
behavioral1
Sample
315210b2e4a9d0e072bae919377ff43aa9e8834313335cabef4a048b48a8bbec.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
315210b2e4a9d0e072bae919377ff43aa9e8834313335cabef4a048b48a8bbec.exe
Resource
win10v2004-20230221-en
Malware Config
Extracted
redline
sony
193.233.20.33:4125
-
auth_value
1d93d1744381eeb4fcfd7c23ffe0f0b4
Extracted
redline
fort
193.233.20.33:4125
-
auth_value
5ea5673154a804d8c80f565f7276f720
Extracted
amadey
3.68
62.204.41.87/joomla/index.php
Extracted
raccoon
301867536c206e3dae52e6d17c16cc9b
http://213.226.100.108/
Extracted
aurora
212.87.204.93:8081
Targets
-
-
Target
315210b2e4a9d0e072bae919377ff43aa9e8834313335cabef4a048b48a8bbec.exe
-
Size
1.0MB
-
MD5
2411653655b03e21b87a7684d6ab1539
-
SHA1
2a296c22ca1f499fb8735fcae8c2be6064a4cbcf
-
SHA256
315210b2e4a9d0e072bae919377ff43aa9e8834313335cabef4a048b48a8bbec
-
SHA512
f8e3fd805951a0a9d9b47789f9d118c60bc2b954a634cf6a727f88e5e076c33f4302543857f87d357e6a92f1b4d46be02f5df68a537daced74b36eab0f667d26
-
SSDEEP
24576:3y5Hm2RBA5C5+L/sb/perCZcbxEhP2H9M/U1ef:CN8tkb/peWONc2H9a
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-