General
- Target Ghost_VPN_Free_setup.zip
- Size 933KB
- Sample230329-ws6xvsba4s
- SHA256 bc99d1bb9a12367979fcd24b696af85816f730c968f4e99df1c506ca99fa709f
- MD5 1333e94811c5c6684944da819a330524
- SHA1 4c248a332eb42ec2628fd559fbd12d5cf3de49c8
- SHA512 4dece5e82fcf0988bd70bf817a4e2e23e390727d2f9881733f16e5c2db7db1dee54282ffa98186fa9c93d42a66a4ce273e9687f90fa74c15f8ecc8195fcf188c
- SSDEEP 3072:T6PGPdzLz0VA6AcGkFZSC8K4a6A8d6wXdKVhv4jRdIus:7PhYGbEC9K4aUXtM4ps
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
Ghost_VPN_Free_setup.exe
Resource
win7-20230220-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
Ghost_VPN_Free_setup.exe
Resource
win10v2004-20230220-en
6 signatures
150 seconds
Malware Config
Extracted
Family
-
redline
C2
-
37.220.87.13:48790
Attributes
-
auth_value
7da9acd8c6c263ef0dde36b5fd07c25f
Targets
-
- Target Ghost_VPN_Free_setup.exe
- Size 800.4MB
- SHA256 4556643b2e3a495d9a11e054688f706fcde07aa49d103b9993c7ef98090e003f
- MD5 3c00627a91193bc8e85f4301d2d0541e
- SHA1 9abe13ec9cd673b1d32f866a4285d334cf3b0363
- SHA512 9d9037436c3b1ea6cba947753a34a37aa571e9a9bb9ec930884d502b7502a86d5faa91b1b21e2f8144b8ace96bf4491a6384a60b717ab1f81b8e66c8dd58deb7
- SSDEEP 393216:CUwOIEK84WQsykAeYYkAeYUaMImg8C0Qu:
- MD5 SHA1 SHA512 SSDEEP
Score10/10-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Suspicious use of SetThreadContext