General
-
Target
file.exe
-
Size
980KB
-
Sample
230411-nyfc4adh4t
-
MD5
decba982a30f783c2ab5b031a9c62917
-
SHA1
2a740df10598434978649c343cf7bb4ece2a48d0
-
SHA256
6044fd753298adf002b66cb2fb1f237f73678b7422637c0148adf891a975f0d1
-
SHA512
d985359bbc95b5aca29c5ed9c6fb2e6227cd04bc6183a928bf4147dd4c029765a6c6224a560686c36aa434b69b3a667a30e194e9405eafc87d2ed7e0f2349afc
-
SSDEEP
24576:oySyHBlJ8craC/5pZmEeITDo75azoqrA9B+HG:vxhlu+kEeITDo8rA9Bq
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Targets
-
-
Target
file.exe
-
Size
980KB
-
MD5
decba982a30f783c2ab5b031a9c62917
-
SHA1
2a740df10598434978649c343cf7bb4ece2a48d0
-
SHA256
6044fd753298adf002b66cb2fb1f237f73678b7422637c0148adf891a975f0d1
-
SHA512
d985359bbc95b5aca29c5ed9c6fb2e6227cd04bc6183a928bf4147dd4c029765a6c6224a560686c36aa434b69b3a667a30e194e9405eafc87d2ed7e0f2349afc
-
SSDEEP
24576:oySyHBlJ8craC/5pZmEeITDo75azoqrA9B+HG:vxhlu+kEeITDo8rA9Bq
Score10/10-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-