General
-
Target
67be978a3318ac18b192ebe5a03739d40df6e80fb8a53ddd18fb595d59817fff.bin
-
Size
1.2MB
-
Sample
230506-18rkbsdf5v
-
MD5
d2cf768c2aef9df50031b6a63530f700
-
SHA1
3654827e43a5f3a95a887c2dfc678fe6bfa5fefc
-
SHA256
67be978a3318ac18b192ebe5a03739d40df6e80fb8a53ddd18fb595d59817fff
-
SHA512
07503c824658f15e48c2388d95088872daef98409247b6f784e388ea6a623bffda20f0e51dcfb90f6a16d2344bbd7083bb0761e486de4aa062847106c6791da0
-
SSDEEP
24576:+yo/SWRHS6P+H/n3840bgLRLG6o9kL7LVGQt0X5L9:No/7+H/s+o6o9Q4
Static task
static1
Behavioral task
behavioral1
Sample
67be978a3318ac18b192ebe5a03739d40df6e80fb8a53ddd18fb595d59817fff.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
67be978a3318ac18b192ebe5a03739d40df6e80fb8a53ddd18fb595d59817fff.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
gena
185.161.248.73:4164
-
auth_value
d05bf43eef533e262271449829751d07
Extracted
redline
life
185.161.248.73:4164
-
auth_value
8685d11953530b68ad5ec703809d9f91
Targets
-
-
Target
67be978a3318ac18b192ebe5a03739d40df6e80fb8a53ddd18fb595d59817fff.bin
-
Size
1.2MB
-
MD5
d2cf768c2aef9df50031b6a63530f700
-
SHA1
3654827e43a5f3a95a887c2dfc678fe6bfa5fefc
-
SHA256
67be978a3318ac18b192ebe5a03739d40df6e80fb8a53ddd18fb595d59817fff
-
SHA512
07503c824658f15e48c2388d95088872daef98409247b6f784e388ea6a623bffda20f0e51dcfb90f6a16d2344bbd7083bb0761e486de4aa062847106c6791da0
-
SSDEEP
24576:+yo/SWRHS6P+H/n3840bgLRLG6o9kL7LVGQt0X5L9:No/7+H/s+o6o9Q4
Score10/10-
Detects Redline Stealer samples
This rule detects the presence of Redline Stealer samples based on their unique strings.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-