General
-
Target
3e72829c620bdc3e68ac7be4d3680a66.bin
-
Size
968KB
-
Sample
230328-bs4ghsgc48
-
MD5
3af9a8a44c07b1669930c4147cc2997d
-
SHA1
86c74f17757416ad5b6ab60cb931f8f3de473e0f
-
SHA256
ffa8e572045693bed971ee2a17c15699edfa25863708e81adc85004bb61d6fb7
-
SHA512
11bc34b4ce2696a8fe204b2529eab6d3cc4bd40d6cfd19c175c9b30924ba9b2b9bb34fd7ac8ac4ab8a102627e3d3fcd3abc7c045a86bbd786e3b5adc254091ba
-
SSDEEP
24576:wIlVOB9L/J24V6BgMhoXMy3Zn+Ori13ADcFjDF:wystvwrovn++iCDctZ
Static task
static1
Behavioral task
behavioral1
Sample
c8a83a59adf0cc70f7e283b74866cd00747030e34e18cf1367a9b3ed76e00efb.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
c8a83a59adf0cc70f7e283b74866cd00747030e34e18cf1367a9b3ed76e00efb.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
sony
193.233.20.33:4125
-
auth_value
1d93d1744381eeb4fcfd7c23ffe0f0b4
Extracted
redline
fort
193.233.20.33:4125
-
auth_value
5ea5673154a804d8c80f565f7276f720
Extracted
amadey
3.68
62.204.41.87/joomla/index.php
Extracted
raccoon
301867536c206e3dae52e6d17c16cc9b
http://213.226.100.108/
Extracted
aurora
212.87.204.93:8081
Targets
-
-
Target
c8a83a59adf0cc70f7e283b74866cd00747030e34e18cf1367a9b3ed76e00efb.bin
-
Size
1012KB
-
MD5
3e72829c620bdc3e68ac7be4d3680a66
-
SHA1
2940c6b0f84f7337be41dda0260f3c29c16d8a07
-
SHA256
c8a83a59adf0cc70f7e283b74866cd00747030e34e18cf1367a9b3ed76e00efb
-
SHA512
45f3313bc4863e56e2f1d88cfbd4bcba485f107c87505e94ee79b315450e164a5d1c76e456814aa2cbe2ef6fd9bf59263f4de4196df02a01423ea3feccf235f6
-
SSDEEP
24576:Nyp8vPnyoU5RJlCPkqYRkWPM/Lx5XzzBt3DIv:op8XynrCPkqYRkeMjxX
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-