Analysis
-
max time kernel
140s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
05-05-2023 18:09
Behavioral task
behavioral1
Sample
0x000900000001276d6560.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
0x000900000001276d6560.exe
Resource
win10v2004-20230220-en
General
-
Target
0x000900000001276d6560.exe
-
Size
168KB
-
MD5
4e3e577e6a2213e9a9a507c5fc608b17
-
SHA1
bfa1277b76d6cd66e8399ddd8cb5ad9588e588a0
-
SHA256
f691f11f0ff851056d9662c1af94f8a73555d649af3ef894698ef0f1eeaa6bb3
-
SHA512
079fd94c705fc9e879ce5cc3530f186d25c057443021a57fa862d9f52103983a386f6232c1e25fa902d91bdf2aedec436d7eb2904a37a8062ba73344e63414db
-
SSDEEP
1536:ncJK7qlVZRGW4XqrozC3iGOmE+lrcI2nBCTGqV8buV+jys0ausT83wYk98e8he:nc4VVzxNf3qV0/yNausTb8e8he
Malware Config
Extracted
redline
life
185.161.248.73:4164
-
auth_value
8685d11953530b68ad5ec703809d9f91
Signatures
-
Detects Redline Stealer samples 1 IoCs
This rule detects the presence of Redline Stealer samples based on their unique strings.
Processes:
resource yara_rule behavioral2/memory/4228-134-0x000000000A840000-0x000000000AE58000-memory.dmp redline_stealer -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4228-133-0x00000000002E0000-0x000000000030E000-memory.dmpFilesize
184KB
-
memory/4228-134-0x000000000A840000-0x000000000AE58000-memory.dmpFilesize
6.1MB
-
memory/4228-135-0x000000000A330000-0x000000000A43A000-memory.dmpFilesize
1.0MB
-
memory/4228-136-0x0000000002780000-0x0000000002792000-memory.dmpFilesize
72KB
-
memory/4228-137-0x0000000004E30000-0x0000000004E6C000-memory.dmpFilesize
240KB
-
memory/4228-138-0x0000000004E90000-0x0000000004EA0000-memory.dmpFilesize
64KB
-
memory/4228-139-0x0000000004E90000-0x0000000004EA0000-memory.dmpFilesize
64KB