General
-
Target
90a84d264fc43fa31e07b32a390fe52f46986963083e23dc809a1ac76510a3ec
-
Size
660KB
-
Sample
230403-xa1tkage46
-
MD5
af693cd27a9b597e7280cd8d1125b84e
-
SHA1
b13b326a57bf54ff38ae894d194172ac7df55d3a
-
SHA256
90a84d264fc43fa31e07b32a390fe52f46986963083e23dc809a1ac76510a3ec
-
SHA512
392dc2523238b7fab9eb720ff409b550150a110a3dd422be911e62754aca8e5872426ec43c93f5f5ef5561e57cb88138504b2b29fa97e2e32ea697df2eba92cf
-
SSDEEP
12288:XMrsy90fm2v8lQvqJhOpqJ67489149GZSdg8Lgl6xaYp0S:zyUmQZU4pqJct1OdgZs0y
Static task
static1
Behavioral task
behavioral1
Sample
90a84d264fc43fa31e07b32a390fe52f46986963083e23dc809a1ac76510a3ec.exe
Resource
win10-20230220-en
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Targets
-
-
Target
90a84d264fc43fa31e07b32a390fe52f46986963083e23dc809a1ac76510a3ec
-
Size
660KB
-
MD5
af693cd27a9b597e7280cd8d1125b84e
-
SHA1
b13b326a57bf54ff38ae894d194172ac7df55d3a
-
SHA256
90a84d264fc43fa31e07b32a390fe52f46986963083e23dc809a1ac76510a3ec
-
SHA512
392dc2523238b7fab9eb720ff409b550150a110a3dd422be911e62754aca8e5872426ec43c93f5f5ef5561e57cb88138504b2b29fa97e2e32ea697df2eba92cf
-
SSDEEP
12288:XMrsy90fm2v8lQvqJhOpqJ67489149GZSdg8Lgl6xaYp0S:zyUmQZU4pqJct1OdgZs0y
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-