General
-
Target
529e0f9084a5f667b20542adafb1acb39ef5e19b7871b0564e80ed14f39f3fa6.bin
-
Size
1.5MB
-
Sample
230506-1s775sbh2x
-
MD5
bc76a83088b3f9efa042b3b338f294bf
-
SHA1
faecbf4e686646141729f2784832c4308b2932bf
-
SHA256
529e0f9084a5f667b20542adafb1acb39ef5e19b7871b0564e80ed14f39f3fa6
-
SHA512
c6fd6d8fc5bb6f5bbb49c9949d07fe77d92c556e9b49ed42fc0660650d08e7b9fdd297cf77a7af5e33ee75924fc31fde54351511f94d98dfc54feed4cb666335
-
SSDEEP
49152:Xa/N9vsEEsintmhgMRsTmc8VfKo43g8U6C:GCBdtmhgIs6cKfKWo
Static task
static1
Behavioral task
behavioral1
Sample
529e0f9084a5f667b20542adafb1acb39ef5e19b7871b0564e80ed14f39f3fa6.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
529e0f9084a5f667b20542adafb1acb39ef5e19b7871b0564e80ed14f39f3fa6.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
amadey
3.70
212.113.119.255/joomla/index.php
Extracted
redline
gena
185.161.248.73:4164
-
auth_value
d05bf43eef533e262271449829751d07
Extracted
redline
life
185.161.248.73:4164
-
auth_value
8685d11953530b68ad5ec703809d9f91
Targets
-
-
Target
529e0f9084a5f667b20542adafb1acb39ef5e19b7871b0564e80ed14f39f3fa6.bin
-
Size
1.5MB
-
MD5
bc76a83088b3f9efa042b3b338f294bf
-
SHA1
faecbf4e686646141729f2784832c4308b2932bf
-
SHA256
529e0f9084a5f667b20542adafb1acb39ef5e19b7871b0564e80ed14f39f3fa6
-
SHA512
c6fd6d8fc5bb6f5bbb49c9949d07fe77d92c556e9b49ed42fc0660650d08e7b9fdd297cf77a7af5e33ee75924fc31fde54351511f94d98dfc54feed4cb666335
-
SSDEEP
49152:Xa/N9vsEEsintmhgMRsTmc8VfKo43g8U6C:GCBdtmhgIs6cKfKWo
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-