General
-
Target
68f4fffa0655da67fe4314d3a0108fe1.bin
-
Size
1.2MB
-
Sample
230506-19j7msca43
-
MD5
68f4fffa0655da67fe4314d3a0108fe1
-
SHA1
0be190df38f794040fad8a79af7990c8fd15789c
-
SHA256
440ca6ae933fb42123ed2368c8d725c51752a31210492a1c731bebc5e1b9a900
-
SHA512
ee1ef526b07db4b92d0d08f245cb1e1f0be4ae8fc840d0354e7aa5d6c377759671bb95ac86f74d7585c09b09339a6048d75c8b6bdf4fa34f15570ef25f00b3dc
-
SSDEEP
24576:sykFF3Y25qn+8drBh3UAQf/AQGHhRAZc8sS+1anUJTZ4:b4oWq+Oh9miKVianUJTZ
Static task
static1
Behavioral task
behavioral1
Sample
68f4fffa0655da67fe4314d3a0108fe1.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
68f4fffa0655da67fe4314d3a0108fe1.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
gena
185.161.248.73:4164
-
auth_value
d05bf43eef533e262271449829751d07
Extracted
redline
life
185.161.248.73:4164
-
auth_value
8685d11953530b68ad5ec703809d9f91
Targets
-
-
Target
68f4fffa0655da67fe4314d3a0108fe1.bin
-
Size
1.2MB
-
MD5
68f4fffa0655da67fe4314d3a0108fe1
-
SHA1
0be190df38f794040fad8a79af7990c8fd15789c
-
SHA256
440ca6ae933fb42123ed2368c8d725c51752a31210492a1c731bebc5e1b9a900
-
SHA512
ee1ef526b07db4b92d0d08f245cb1e1f0be4ae8fc840d0354e7aa5d6c377759671bb95ac86f74d7585c09b09339a6048d75c8b6bdf4fa34f15570ef25f00b3dc
-
SSDEEP
24576:sykFF3Y25qn+8drBh3UAQf/AQGHhRAZc8sS+1anUJTZ4:b4oWq+Oh9miKVianUJTZ
Score10/10-
Detects Redline Stealer samples
This rule detects the presence of Redline Stealer samples based on their unique strings.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-