General
-
Target
3bf207dfed8e18fe10d53c6b8cda1d2123f33be8945230ec5cdbf94213a90e34
-
Size
490KB
-
Sample
230507-k4erzafb2x
-
MD5
640427557f9d7f81d7106f3e74d52be2
-
SHA1
3aa1f5efe2637a3d2d16aac2118b31f13165caa7
-
SHA256
3bf207dfed8e18fe10d53c6b8cda1d2123f33be8945230ec5cdbf94213a90e34
-
SHA512
e61cc31d6474705a73d8a1bce5662e46ea36043ffccfbaaa35886e94ff41b9337631774b828cce51f833f2e9e801fe8fe8dcf5b91021bb599752f2b0acec6282
-
SSDEEP
12288:bMr2y90VyaSCtFFPQwObak+iV6/Pz7IuNE+ukO5:dy4SHwAV+l4+Y
Static task
static1
Behavioral task
behavioral1
Sample
3bf207dfed8e18fe10d53c6b8cda1d2123f33be8945230ec5cdbf94213a90e34.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
lada
217.196.96.101:4132
-
auth_value
0b3678897547fedafe314eda5a2015ba
Extracted
amadey
3.70
212.113.119.255/joomla/index.php
Targets
-
-
Target
3bf207dfed8e18fe10d53c6b8cda1d2123f33be8945230ec5cdbf94213a90e34
-
Size
490KB
-
MD5
640427557f9d7f81d7106f3e74d52be2
-
SHA1
3aa1f5efe2637a3d2d16aac2118b31f13165caa7
-
SHA256
3bf207dfed8e18fe10d53c6b8cda1d2123f33be8945230ec5cdbf94213a90e34
-
SHA512
e61cc31d6474705a73d8a1bce5662e46ea36043ffccfbaaa35886e94ff41b9337631774b828cce51f833f2e9e801fe8fe8dcf5b91021bb599752f2b0acec6282
-
SSDEEP
12288:bMr2y90VyaSCtFFPQwObak+iV6/Pz7IuNE+ukO5:dy4SHwAV+l4+Y
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-