General
-
Target
2936c28076b8434601dba5322b3bef97.exe
-
Size
323KB
-
Sample
230406-n1qlvach63
-
MD5
2936c28076b8434601dba5322b3bef97
-
SHA1
4dfc412181278822c5e64b831028b06f0dd62ae5
-
SHA256
875d856c37fde99e43deb9fefb56e49a59687aa1fbf830b1b126168a29128e31
-
SHA512
b88a2d50a0dc1a42ebe4ac2b3a44ccfa6648f5bafe2287a553e8801fea9bc66649be28811330ccb502c11d4ef2ca3a1760e7f4f64112a53250cd6fa75adf5ddb
-
SSDEEP
6144:vYa6juASI1KIq56x+vAKC5Fyqs8itGi4dG4z08Erlf5dCmjpEcxk5rarP:vYJeIq5TvALfyqBiMJdG4zmrlfvbHxIY
Static task
static1
Behavioral task
behavioral1
Sample
2936c28076b8434601dba5322b3bef97.exe
Resource
win7-20230220-en
Malware Config
Extracted
redline
cheat
david1234.duckdns.org:38369
Targets
-
-
Target
2936c28076b8434601dba5322b3bef97.exe
-
Size
323KB
-
MD5
2936c28076b8434601dba5322b3bef97
-
SHA1
4dfc412181278822c5e64b831028b06f0dd62ae5
-
SHA256
875d856c37fde99e43deb9fefb56e49a59687aa1fbf830b1b126168a29128e31
-
SHA512
b88a2d50a0dc1a42ebe4ac2b3a44ccfa6648f5bafe2287a553e8801fea9bc66649be28811330ccb502c11d4ef2ca3a1760e7f4f64112a53250cd6fa75adf5ddb
-
SSDEEP
6144:vYa6juASI1KIq56x+vAKC5Fyqs8itGi4dG4z08Erlf5dCmjpEcxk5rarP:vYJeIq5TvALfyqBiMJdG4zmrlfvbHxIY
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
SectopRAT payload
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-