General
-
Target
https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbGlaY3Q2bFVpVVpZWlVpa3lRanowX3R0a3Rod3xBQ3Jtc0tuYk5jU2VUTFdCVGxZZjVjMUp0MXNVdG5FUGwzQkxzVUNDV1ZVVjNzRTF2OVcwaGlKQnVPLTc3M2Ruemd0QzRwRUJ6by1tVE1kZGdWdDN1bXRYTW8zRktoSlBIelczQW9ZNzc4Z25hSngxSDMxWVRMWQ&q=https%3A%2F%2Flavacheat.com%2Fcheat%2Fsot-5040&v=0YO5nVTPCmA
-
Sample
230402-l9l9nsfg83
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbGlaY3Q2bFVpVVpZWlVpa3lRanowX3R0a3Rod3xBQ3Jtc0tuYk5jU2VUTFdCVGxZZjVjMUp0MXNVdG5FUGwzQkxzVUNDV1ZVVjNzRTF2OVcwaGlKQnVPLTc3M2Ruemd0QzRwRUJ6by1tVE1kZGdWdDN1bXRYTW8zRktoSlBIelczQW9ZNzc4Z25hSngxSDMxWVRMWQ&q=https%3A%2F%2Flavacheat.com%2Fcheat%2Fsot-5040&v=0YO5nVTPCmA
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
Scarflog
135.181.49.56:17248
-
auth_value
01eab890df4b5da430be4638d836c22f
Targets
-
-
Target
https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbGlaY3Q2bFVpVVpZWlVpa3lRanowX3R0a3Rod3xBQ3Jtc0tuYk5jU2VUTFdCVGxZZjVjMUp0MXNVdG5FUGwzQkxzVUNDV1ZVVjNzRTF2OVcwaGlKQnVPLTc3M2Ruemd0QzRwRUJ6by1tVE1kZGdWdDN1bXRYTW8zRktoSlBIelczQW9ZNzc4Z25hSngxSDMxWVRMWQ&q=https%3A%2F%2Flavacheat.com%2Fcheat%2Fsot-5040&v=0YO5nVTPCmA
Score10/10-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-