General
-
Target
ac33c2313b97cd499bec59936e01ce637cdd52244b3d3f7347450872b125c703.bin
-
Size
1.5MB
-
Sample
230505-xlck4she3z
-
MD5
b8fd8755689fc39a7837fd229991c7f3
-
SHA1
7347af99cad99c8859f76939a1cfccd4313dd750
-
SHA256
ac33c2313b97cd499bec59936e01ce637cdd52244b3d3f7347450872b125c703
-
SHA512
df2da218a151762c435b88bd3bdab9c0dffa807a622516101f0fd45ab71a2d2b6a25dbc9e4d940a4dc49189a28e1d1146250bc4989586d405adfdecea611de97
-
SSDEEP
24576:zyJN1QKcmDaQeLE5mstgxabiJB4xoIY1dvjgxYz9LuMXRvKdEwsrMTvK:Gb1QY6I55tUa1odLFcGGEwsrq
Static task
static1
Behavioral task
behavioral1
Sample
ac33c2313b97cd499bec59936e01ce637cdd52244b3d3f7347450872b125c703.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
ac33c2313b97cd499bec59936e01ce637cdd52244b3d3f7347450872b125c703.exe
Resource
win10v2004-20230221-en
Malware Config
Extracted
amadey
3.70
212.113.119.255/joomla/index.php
Extracted
redline
gena
185.161.248.73:4164
-
auth_value
d05bf43eef533e262271449829751d07
Extracted
redline
life
185.161.248.73:4164
-
auth_value
8685d11953530b68ad5ec703809d9f91
Targets
-
-
Target
ac33c2313b97cd499bec59936e01ce637cdd52244b3d3f7347450872b125c703.bin
-
Size
1.5MB
-
MD5
b8fd8755689fc39a7837fd229991c7f3
-
SHA1
7347af99cad99c8859f76939a1cfccd4313dd750
-
SHA256
ac33c2313b97cd499bec59936e01ce637cdd52244b3d3f7347450872b125c703
-
SHA512
df2da218a151762c435b88bd3bdab9c0dffa807a622516101f0fd45ab71a2d2b6a25dbc9e4d940a4dc49189a28e1d1146250bc4989586d405adfdecea611de97
-
SSDEEP
24576:zyJN1QKcmDaQeLE5mstgxabiJB4xoIY1dvjgxYz9LuMXRvKdEwsrMTvK:Gb1QY6I55tUa1odLFcGGEwsrq
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-